10 ms·

Perhaps we should wait to get the whole story to discuss. Didn't we just go through this with the "Apple doesn't return 30% on refund" fiasco last week?

gruez 6y ago
Isn't silently revoking a longtime mac developer's certificate bad practice, regardless of the justification?
- beervirus 6y ago
  Isn't keeping the 30% on refunded apps bad practice, regardless of the justification? Well, yes, if it's true, which it wasn't.
  - gruez 6y ago
    Okay, so what are the situations where it can be false? * apple actually did communicate to them, but it was via carrier pigeon or something and it got lost * apple is under gag order * the developer is actually a long time repeat offender and is trying to evade via sockpuppet accounts None of them seem plausible to me. Also, unlike with the apple 30% refund fiasco, we know for sure this is happening, because other users are tweeting that they're receiving error messages when trying to install his software.
    - hunter2_ 6y ago
      How does other users receiving errors prove that the developer received no warning? Your first bullet point seems entirely plausible, albeit the failure mode is likely less avian.
      - charlieMonroe 6y ago
        Hi, I'm the developer. * No email in my spam box. * My contact address is still working and have received notifications about them approving my updates for the App Store yesterday (so saying that they have no way of contacting me is not true). * No known breach of account. * No accidental revocation (I was sleeping while this happened). * The certificates are revoked as you can verify via command line.
        sjs382 6y ago
        Please keep us updated with what comes of this!
        charlieMonroe 6y ago
        See https://blog.charliemonroe.net/a-day-without-business/ https://blog.charliemonroe.net/a-day-without-business/
    - sjs382 6y ago
      It doesn't take much imagination to come up with other scenarios. No idea if any of these are true. * apple actually did communicate to them, but it went to the developer's spam box. * apple actually did communicate to them, but sent it to an old email address that the developer never updated. * apple actually did communicate to them, but it was via a developer dashboard that the developer rarely checks. * apple didn't revoke it. something else is going on.
      - hunter2_ 6y ago
        You make all good points except for the dashboard. I don't believe that posting a message on your own property can be construed as sending a communication (and for something like this situation, we're talking about sending when we say communicating). It would be like having to go to a lender's headquarters for financial statements and tax documents.
      - gruez 6y ago
        >* apple actually did communicate to them, but it went to the developer's spam box. Isn't "check your spam box" the same thing you're going to do if you're looking for an email that you're expecting? >* apple actually did communicate to them, but sent it to an old email address that the developer never updated. plausible, but seems unlikely that'd be the case, considering that this is a semi-important account that you won't use a throwaway account for. Also, isn't your itunes connect (app store) login based on your apple id, which is based on your email? >* apple actually did communicate to them, but it was via a developer dashboard that the developer rarely checks. His tweet said that his account was suspended, so he probably found that out while trying to log in, or got an email.
      - _qulr 6y ago
        > apple actually did communicate to them, but it went to the developer's spam box. Why are so many people assuming that Apple would only email a developer about revoking their certificate, a drastic action that suddenly kills all of the developer's apps? Apple has the phone number of every member of their developer program. Anything less than an immediate phone call from Apple in this situation would be gross negligence. > apple didn't revoke it. something else is going on. It's revoked. Any Mac user can verify this with "codesign --verify" on any of the apps on the developer's website that are still available for download.
    - ballenf 6y ago
      - Developer was hacked and is unaware of it. - Developer accidentally clicked "revoke my cert" (no idea if that's a real button, but that's not the point). - A national security agency sent one of those scary letters preventing Apple from speaking but requiring the action. - Developer had a mental breakdown and has lost grip on reality. - Developer realized app was infected with malware and ... Truth is stranger than fiction, so it's actually really hard to think of all the possible strange explanations. Which is why it seems imminently reasonable to take a wait and see approach at least for a reasonable period of time.
      - gruez 6y ago
        > - Developer was hacked and is unaware of it. If that's the case why wasn't that communicated to him? >- Developer accidentally clicked "revoke my cert" (no idea if that's a real button, but that's not the point). >- Developer had a mental breakdown and has lost grip on reality. While these are possible, they seem very unlikely. Compare the numerous cases of Big Tech silently revoking people's account with no notice or appeal, to the number of times that someone made a public announcement, and then went "nvm it was me lol".
        ilikehurdles 6y ago
        Big Tech is not a monolithic entity and citing cases across different entities may not be an appropriate way to compare these issues. Asking for patience while both sides have a chance to explain the situation is reasonable. Also, whenever you suggest something is "very unlikely," keep in mind that this likelihood is one instance in the context of 20 million developers. Are you suggesting it's like a 1 out of 100 chance, or a 1 out of 20 million chance?
      - LorenPechtel 6y ago
        You first case is the first thing that came to mind--his certificate was found to have signed malware. They would revoke without notice in such a situation.
    - moogleii 6y ago
      > Okay, so what are the situations where it can be false? I think many people ask themselves that just before they grab the pitchforks.
  - draw_down 6y ago
    Yeah I guess all the people yelling at this guy that his app doesn’t work are all just made up.
- michaelt 6y ago
  If their certificate had been stolen it would be expected. Stolen code signing certificates have been used to distribute malware in the past; for example Stuxnet. Of course, you'd expect a notification from Apple saying they'd done that and why; and plenty of safety measures to prevent mistaken revocations. That's not to say I support mandatory code signing - merely that if you're going to have code signing, you also need to revoke stolen certs.
swiley 6y ago
Honestly it doesn’t matter at all if it actually happened, that they could is unacceptable. EDIT: To be clear, it's not the certificate revocation that's bad, it's that the certificate is required to distribute code and can only be acquired from a single organization.
- epistasis 6y ago
  I think certificate revocation of signed code is a good, useful feature and something that I want as part of my security infrastructure. I wouldn't want it any other way if I have to use non-open source code that I can't inspect. But the basis of all my core software is going to be open source.
  - raxxorrax 6y ago
    This will lead to computing being locked down further with really questionable benefits. In fact open source software can suffer greatly because these certs make deployment cost non-zero. So someone providing binaries of such software has to pay for it to large corps like Apple and Microsoft.
    - epistasis 6y ago
      We've been in this situation for 10 years now. Has the slippery slope caused any sliding yet? The cost issue is separate from the revocation issue, and my point was about certain revocation--it's an absolutely great feature for any code signing situation where you are trusting others to compile code for you and others can't confirm that a certain set of binaries came from a certain set of source files. (Reproducible builds could help, of course!)
      - raxxorrax 6y ago
        Eh, yes, we have much more locked down systems with reduced capabilities. Consoles used it maybe for years and they are notorious for being useless for any third party content. You cannot simply write your own drivers for several devices anymore, so you basically booted a lot of engineers. It infected whole industries. We have locked down agricultural devices where users pay for expensive hacks. It is a complete nightmare actually. For security... sure... actually not even my grandmother would believe it.
_qulr 6y ago
Except that it's been verified by many people, and you can verify on your own Mac, that the developer's certificate has indeed been revoked, and the apps don't work. That part of the story is indisputable.
- cdubzzz 6y ago
  Sure but the important part of the tweet is “with no warning”. That’s why it is being posted here.
  - charliemil4 6y ago
    Apple sends out emails about a month before your certificate expires - I bet they didn’t check it and/or thought the expiry would only apply to new builds *replaced pronouns and specified
    - _qulr 6y ago
      The certificate was revoked, not expired. And expired code signing certs don't prevent Mac apps from running, they just prevent new builds from being signed. $ codesign --verify ~/Downloads/Eon_977.dmg CSSMERR_TP_CERT_REVOKED
  - deleted 6y ago
    [deleted]
- echelon 6y ago
  Honestly, no company should have this much control over people's businesses and livelihoods. iPhone is a generic pocket computer, and it has outgrown Apple's desire to maintain a fiefdom. Congress and the EU should force Apple to allow 3rd party marketplaces and installs. Apple is free to charge 30% for the App Store, but they can't be the only way to get code onto an iPhone. Nor should they be the only first class way of doing it. Edit: I frequently get downvotes because of this. Who really wants everything going through Apple 100% of the time? I don't understand this perspective at all. Do you like not having control of your devices?

gruez 6y ago

Isn't silently revoking a longtime mac developer's certificate bad practice, regardless of the justification?

beervirus 6y ago
Isn't keeping the 30% on refunded apps bad practice, regardless of the justification? Well, yes, if it's true, which it wasn't.
- gruez 6y ago
  Okay, so what are the situations where it can be false? * apple actually did communicate to them, but it was via carrier pigeon or something and it got lost * apple is under gag order * the developer is actually a long time repeat offender and is trying to evade via sockpuppet accounts None of them seem plausible to me. Also, unlike with the apple 30% refund fiasco, we know for sure this is happening, because other users are tweeting that they're receiving error messages when trying to install his software.
  - hunter2_ 6y ago
    How does other users receiving errors prove that the developer received no warning? Your first bullet point seems entirely plausible, albeit the failure mode is likely less avian.
    - charlieMonroe 6y ago
      Hi, I'm the developer. * No email in my spam box. * My contact address is still working and have received notifications about them approving my updates for the App Store yesterday (so saying that they have no way of contacting me is not true). * No known breach of account. * No accidental revocation (I was sleeping while this happened). * The certificates are revoked as you can verify via command line.
      - sjs382 6y ago
        Please keep us updated with what comes of this!
        charlieMonroe 6y ago
        See https://blog.charliemonroe.net/a-day-without-business/ https://blog.charliemonroe.net/a-day-without-business/
  - sjs382 6y ago
    It doesn't take much imagination to come up with other scenarios. No idea if any of these are true. * apple actually did communicate to them, but it went to the developer's spam box. * apple actually did communicate to them, but sent it to an old email address that the developer never updated. * apple actually did communicate to them, but it was via a developer dashboard that the developer rarely checks. * apple didn't revoke it. something else is going on.
    - hunter2_ 6y ago
      You make all good points except for the dashboard. I don't believe that posting a message on your own property can be construed as sending a communication (and for something like this situation, we're talking about sending when we say communicating). It would be like having to go to a lender's headquarters for financial statements and tax documents.
    - gruez 6y ago
      >* apple actually did communicate to them, but it went to the developer's spam box. Isn't "check your spam box" the same thing you're going to do if you're looking for an email that you're expecting? >* apple actually did communicate to them, but sent it to an old email address that the developer never updated. plausible, but seems unlikely that'd be the case, considering that this is a semi-important account that you won't use a throwaway account for. Also, isn't your itunes connect (app store) login based on your apple id, which is based on your email? >* apple actually did communicate to them, but it was via a developer dashboard that the developer rarely checks. His tweet said that his account was suspended, so he probably found that out while trying to log in, or got an email.
    - _qulr 6y ago
      > apple actually did communicate to them, but it went to the developer's spam box. Why are so many people assuming that Apple would only email a developer about revoking their certificate, a drastic action that suddenly kills all of the developer's apps? Apple has the phone number of every member of their developer program. Anything less than an immediate phone call from Apple in this situation would be gross negligence. > apple didn't revoke it. something else is going on. It's revoked. Any Mac user can verify this with "codesign --verify" on any of the apps on the developer's website that are still available for download.
  - ballenf 6y ago
    - Developer was hacked and is unaware of it. - Developer accidentally clicked "revoke my cert" (no idea if that's a real button, but that's not the point). - A national security agency sent one of those scary letters preventing Apple from speaking but requiring the action. - Developer had a mental breakdown and has lost grip on reality. - Developer realized app was infected with malware and ... Truth is stranger than fiction, so it's actually really hard to think of all the possible strange explanations. Which is why it seems imminently reasonable to take a wait and see approach at least for a reasonable period of time.
    - gruez 6y ago
      > - Developer was hacked and is unaware of it. If that's the case why wasn't that communicated to him? >- Developer accidentally clicked "revoke my cert" (no idea if that's a real button, but that's not the point). >- Developer had a mental breakdown and has lost grip on reality. While these are possible, they seem very unlikely. Compare the numerous cases of Big Tech silently revoking people's account with no notice or appeal, to the number of times that someone made a public announcement, and then went "nvm it was me lol".
      - ilikehurdles 6y ago
        Big Tech is not a monolithic entity and citing cases across different entities may not be an appropriate way to compare these issues. Asking for patience while both sides have a chance to explain the situation is reasonable. Also, whenever you suggest something is "very unlikely," keep in mind that this likelihood is one instance in the context of 20 million developers. Are you suggesting it's like a 1 out of 100 chance, or a 1 out of 20 million chance?
    - LorenPechtel 6y ago
      You first case is the first thing that came to mind--his certificate was found to have signed malware. They would revoke without notice in such a situation.
  - moogleii 6y ago
    > Okay, so what are the situations where it can be false? I think many people ask themselves that just before they grab the pitchforks.
- draw_down 6y ago
  Yeah I guess all the people yelling at this guy that his app doesn’t work are all just made up.
michaelt 6y ago
If their certificate had been stolen it would be expected. Stolen code signing certificates have been used to distribute malware in the past; for example Stuxnet. Of course, you'd expect a notification from Apple saying they'd done that and why; and plenty of safety measures to prevent mistaken revocations. That's not to say I support mandatory code signing - merely that if you're going to have code signing, you also need to revoke stolen certs.

swiley 6y ago

Honestly it doesn’t matter at all if it actually happened, that they could is unacceptable. EDIT: To be clear, it's not the certificate revocation that's bad, it's that the certificate is required to distribute code and can only be acquired from a single organization.

epistasis 6y ago
I think certificate revocation of signed code is a good, useful feature and something that I want as part of my security infrastructure. I wouldn't want it any other way if I have to use non-open source code that I can't inspect. But the basis of all my core software is going to be open source.
- raxxorrax 6y ago
  This will lead to computing being locked down further with really questionable benefits. In fact open source software can suffer greatly because these certs make deployment cost non-zero. So someone providing binaries of such software has to pay for it to large corps like Apple and Microsoft.
  - epistasis 6y ago
    We've been in this situation for 10 years now. Has the slippery slope caused any sliding yet? The cost issue is separate from the revocation issue, and my point was about certain revocation--it's an absolutely great feature for any code signing situation where you are trusting others to compile code for you and others can't confirm that a certain set of binaries came from a certain set of source files. (Reproducible builds could help, of course!)
    - raxxorrax 6y ago
      Eh, yes, we have much more locked down systems with reduced capabilities. Consoles used it maybe for years and they are notorious for being useless for any third party content. You cannot simply write your own drivers for several devices anymore, so you basically booted a lot of engineers. It infected whole industries. We have locked down agricultural devices where users pay for expensive hacks. It is a complete nightmare actually. For security... sure... actually not even my grandmother would believe it.

_qulr 6y ago

Except that it's been verified by many people, and you can verify on your own Mac, that the developer's certificate has indeed been revoked, and the apps don't work. That part of the story is indisputable.

cdubzzz 6y ago
Sure but the important part of the tweet is “with no warning”. That’s why it is being posted here.
- charliemil4 6y ago
  Apple sends out emails about a month before your certificate expires - I bet they didn’t check it and/or thought the expiry would only apply to new builds *replaced pronouns and specified
  - _qulr 6y ago
    The certificate was revoked, not expired. And expired code signing certs don't prevent Mac apps from running, they just prevent new builds from being signed. $ codesign --verify ~/Downloads/Eon_977.dmg CSSMERR_TP_CERT_REVOKED
- deleted 6y ago
  [deleted]
echelon 6y ago
Honestly, no company should have this much control over people's businesses and livelihoods. iPhone is a generic pocket computer, and it has outgrown Apple's desire to maintain a fiefdom. Congress and the EU should force Apple to allow 3rd party marketplaces and installs. Apple is free to charge 30% for the App Store, but they can't be the only way to get code onto an iPhone. Nor should they be the only first class way of doing it. Edit: I frequently get downvotes because of this. Who really wants everything going through Apple 100% of the time? I don't understand this perspective at all. Do you like not having control of your devices?