4 ms·

I'm not sure what the point of that page or posting it here is. This system (and others like it) is neither new nor special. It's also not a bad thing, and I ha

I'm not sure what the point of that page or posting it here is. This system (and others like it) is neither new nor special. It's also not a bad thing, and I haven't seen anyone come up with a better alternative. Generally you see all major distribution options have signatures with a CA-type trust structure no matter what you use, be it open-source, free or commercial paid software. On Windows, macOS and at least all Linux distros based on dpkg or rpm you have signatures and circumventing that requires a bunch of steps that will prevent most users from shooting themselves in the foot.

saagarjha 6y ago
Question for you: what exactly does Notarization protect against? I have watched all the videos about it, I read the developer documentation, I notarize my apps because it is required by the OS…but I still have not gotten a single good explanation as to why it's useful. Apple claims that the process is extremely tolerant…so does it try to accept everything but blatant malware? Does it let malware through? What happens if malware does get through? Why does having build-specific certificates help security–is there any reason why Apple would disable a single build of an app from a malware publisher?
- oneplane 6y ago
  As far as I know it is intended to prevent identity abuse in both the IRL sense as cryptographic sense. It means that it is harder for an attacker to abuse your systems or key material to sign something in your name. Perhaps the best analogy I can come up with is the dns-01 verification with ACME and a lower TTL. You need to compromise more pieces of the puzzle on a shorter timeline to attack that specific part of the system.
  - saagarjha 6y ago
    Code signing was always a thing, and you can sign your code without notarizing it. And in fact notarization doesn't really seem to have much to do with the person who wrote the thing you are notarizing–you can notarize other people's software!
- crooked-v 6y ago
  > Apple claims that the process is extremely tolerant…so does it try to accept everything but blatant malware? From what I understand, the most common use case here is to match against known malware inserted into an otherwise normal release, either from an infected dev machine or by way of an attacker coopting stolen credentials. It's not going to guard against truly novel malware for obvious reasons, but the vast majority of malware is a repackaging of stuff that's already out there.
  - saagarjha 6y ago
    But Apple can already detect that using XProtect…
- donarb 6y ago
  If you remember Handbrake had a version of their app hacked and uploaded to a distribution server.
  - saagarjha 6y ago
    I do. If I remember correctly, it was the website that was hacked, not the signing certificate that Handbrake used (in fact, I think it used none). Code signing would have worked here.
- raxxorrax 6y ago
  They would never admit it, but gate keeping is another factor from their perspective. I don't judge them on that, it does filter out some crapware, but I don't use OSX or any OS that tries to pull this stuff.

saagarjha 6y ago

Question for you: what exactly does Notarization protect against? I have watched all the videos about it, I read the developer documentation, I notarize my apps because it is required by the OS…but I still have not gotten a single good explanation as to why it's useful. Apple claims that the process is extremely tolerant…so does it try to accept everything but blatant malware? Does it let malware through? What happens if malware does get through? Why does having build-specific certificates help security–is there any reason why Apple would disable a single build of an app from a malware publisher?

oneplane 6y ago
As far as I know it is intended to prevent identity abuse in both the IRL sense as cryptographic sense. It means that it is harder for an attacker to abuse your systems or key material to sign something in your name. Perhaps the best analogy I can come up with is the dns-01 verification with ACME and a lower TTL. You need to compromise more pieces of the puzzle on a shorter timeline to attack that specific part of the system.
- saagarjha 6y ago
  Code signing was always a thing, and you can sign your code without notarizing it. And in fact notarization doesn't really seem to have much to do with the person who wrote the thing you are notarizing–you can notarize other people's software!
crooked-v 6y ago
> Apple claims that the process is extremely tolerant…so does it try to accept everything but blatant malware? From what I understand, the most common use case here is to match against known malware inserted into an otherwise normal release, either from an infected dev machine or by way of an attacker coopting stolen credentials. It's not going to guard against truly novel malware for obvious reasons, but the vast majority of malware is a repackaging of stuff that's already out there.
- saagarjha 6y ago
  But Apple can already detect that using XProtect…
donarb 6y ago
If you remember Handbrake had a version of their app hacked and uploaded to a distribution server.
- saagarjha 6y ago
  I do. If I remember correctly, it was the website that was hacked, not the signing certificate that Handbrake used (in fact, I think it used none). Code signing would have worked here.
raxxorrax 6y ago
They would never admit it, but gate keeping is another factor from their perspective. I don't judge them on that, it does filter out some crapware, but I don't use OSX or any OS that tries to pull this stuff.