4 ms·

Another possible explanation: The developer‘s certificate leaked and was really used to sign malware. Or his github repo was hacked and something evil was added

by planb 6y ago

Another possible explanation: The developer‘s certificate leaked and was really used to sign malware. Or his github repo was hacked and something evil was added to his code without him noticing. Maybe I’m just rationalizing, because if Apple is really going down the road that most commenters here suspect, then there will be no arm macbook for me unfortunately... :(

_qulr 6y ago
When this actually happened in the past, Apple worked closely with the developer: https://panic.com/blog/stolen-source-code/ https://panic.com/blog/stolen-source-code/
ben509 6y ago
So, that's plausible, and I'm trying to wrap my head around the operational model of signed software. Apple has plenty of docs about it [1] [2] [3] but never really get into "how does this work in the long run when things fail" beyond blithely noting that users won't be able to run your stuff and a host of services will start to fail. A CRL / OSCP makes sense, more or less, for websites as they can simply abandon a cert. If the cert leaks, is the remedy really to completely blacklist the certificate? Because that means that anyone who is able to steal the cert can effectively blackmail an author. I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases. I can't imagine how they don't have a separation of concerns given that app certificates must expire. [1]: https://developer.apple.com/support/certificates/ https://developer.apple.com/support/certificates/ [2]: https://help.apple.com/developer-account/#/dev138c9fac7 https://help.apple.com/developer-account/#/dev138c9fac7 [3]: https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html https://developer.apple.com/library/archive/documentation/Se...
- _qulr 6y ago
  > I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases. Yes, this is definitely possible, and why Developer ID signing has a secure timestamp, as specified by the --timestamp flag to the /usr/bin/codesign tool. When Panic's code signing cert was stolen, they revoked it after a certain date, but old versions of their apps continued to be valid and pass Gatekeeper.

by planb 6y ago

_qulr 6y ago

When this actually happened in the past, Apple worked closely with the developer: https://panic.com/blog/stolen-source-code/ https://panic.com/blog/stolen-source-code/

ben509 6y ago

So, that's plausible, and I'm trying to wrap my head around the operational model of signed software. Apple has plenty of docs about it [1] [2] [3] but never really get into "how does this work in the long run when things fail" beyond blithely noting that users won't be able to run your stuff and a host of services will start to fail. A CRL / OSCP makes sense, more or less, for websites as they can simply abandon a cert. If the cert leaks, is the remedy really to completely blacklist the certificate? Because that means that anyone who is able to steal the cert can effectively blackmail an author. I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases. I can't imagine how they don't have a separation of concerns given that app certificates must expire. [1]: https://developer.apple.com/support/certificates/ https://developer.apple.com/support/certificates/ [2]: https://help.apple.com/developer-account/#/dev138c9fac7 https://help.apple.com/developer-account/#/dev138c9fac7 [3]: https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html https://developer.apple.com/library/archive/documentation/Se...

_qulr 6y ago
> I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases. Yes, this is definitely possible, and why Developer ID signing has a secure timestamp, as specified by the --timestamp flag to the /usr/bin/codesign tool. When Panic's code signing cert was stolen, they revoked it after a certain date, but old versions of their apps continued to be valid and pass Gatekeeper.