6 ms·

I would generally like my software, regardless of it is open source or not, not be marked as malware when it is not malware.

saagarjha 6y ago
Sure, but I picked that specifically because it seemed to be what the parent comment was talking about.
- coldtea 6y ago
  Is there any automatic way to tell your software apart from malware? Because that's part of what this mechanism tries to provide...
  - saagarjha 6y ago
    In theory no, that's impossible. In practice, I publish checksums on my website and people trust that I am not malicious.
    - FabHK 6y ago
      The thing is, your friendly scammer could also publish checksums on their website. It is clear to you that you're writing fine open source software, not malware. But how is the consumer supposed to tell? If people trust you, why bother with the checksums? (Over HTTPS, the downloaded content cannot be tampered with. If someone tampered with the content on your website, or performs a MITM, they can also replace the checksums.)
      - saagarjha 6y ago
        The checksums are there if they happen to grab the binary in some way that is not "using HTTPS directly from my website" and they'd like to check. Why do the know I'm not writing malware? Trust in my software, mostly? It is unclear that notarization actually stops malware–Apple has failed to explain how it helps, but enforces it by decree.
        rmrfrmrf 6y ago
        Pretty easy to figure out what's going on: 1. You submit your app bundle and your credentials to Apple for notarization. 2. Apple records your information and goes through each library, framework, and your code, checking the code signing info and "fingerprint" of each for known malware. 3. Apple issues the ticket for stapling to the app bundle. Now say, for example, that libffmpeg-0.1.2-beta2.dylib is found to mine cryptocurrency: 1. Apple goes through their database and finds the app where the malware was reported. 2. Apple marks that fingerprint as malicious. 3. Apple now flags any other apps that use libffmpeg-0.1.2-beta2.dylib (by checking the fingerprint) and disables any versions of any app running that version. Additionally, any other attempts to notarize apps with the malicious dylib are rejected. Notarization provides 2 major benefits for devs that I can see: 1. Apple doesn't need to revoke your entire certificate just to block one version of an app. 2. Apple's audit trail of who notarized the app (and from where) prevents cases where stolen credentials result in a DoS of the victim (e.g. your account being locked, your name and address permabanned, and funds frozen).
        thw0rted 6y ago
        I'd be interested to see the track record since they implemented notarization. How often has it caught malware, both before and after the fact? I haven't seen any headlines about e.g. a popular application failing to launch one day because Apple found a miner in it some time after initial notarization.
        saagarjha 6y ago
        Why can’t Apple just push that through XProtect?
        jolux 6y ago
        Why not do both?
        saagarjha 6y ago
        Because notarization has the very concrete downside of costing money to do, plus the fuzzier steps of it being a fairly complicated and often picky/opaque process to have to deal with when shipping your software.
    - mistersquid 6y ago
      > I publish checksums on my website and people trust that I am not malicious. Users who know how to verify checksums know how to work around unnotarized Mac apps.
      - mcv 6y ago
        It would be nice if the OS automatically verified these checksums. That would have been a nice OS X feature, but instead Apple ignores the verification process that already exists and invents their own, with themselves in control.
        coldtea 6y ago
        >with themselves in control. That's the whole idea to protect from malware. You don't want the software publisher (which could just as well be a malware publisher) in control.
    - Cthulhu_ 6y ago
      I'd rather also have a party in whose interest it is to not get malware on their operating system confirm your claim that your software doesn't contain malware.
    - coldtea 6y ago
      >In theory no, that's impossible It's impossible in the general "is this file malware?" case. It's totally possible in the "is this file a copy of known malware?" case.
  - enriquto 6y ago
    > Is there any automatic way to tell your software apart from malware? There is no universally agreed-upon definition of malware. One man's operating system is another man's malware. For me, an operating system that "calls home" for each new executable you compile is a crystal clear case of malware. In the case of this article, then, the only malware in question is macOS.
    - saagarjha 6y ago
      Plus like this little thing by a guy named Turing…
      - Hackbraten 6y ago
        If an Apple engineer were to compile a variant of Apple’s notarization algorithm where ok means no and no means ok, would the resulting binary notarize its own source fed into it?
        coldtea 6y ago
        Well, if the mechanism is e.g. a blacklist of APIs that shouldn't be used, and a blacklist of known malware hashes (as is the case), then Apple's "is this malware" routine could trivially print "no" for itself. Sorry to the grandparent, but this is nothing like the halting problem...
        saagarjha 6y ago
        This already exists and it is called XProtect. My question through these threads has been "why does notarization exist" and I am still trying to understand why it does, because every answer I have been given simplifies down to "here is a reason that it should exist…wait, that's just what code signing or Apple's built-in MRT does already".
    - coldtea 6y ago
      >There is no universally agreed-upon definition of malware. Doesn't have to be. Just the common user's definition is OK. >For me, an operating system that "calls home" for each new executable you compile is a crystal clear case of malware. In the case of this article, then, the only malware in question is macOS. Which is neither here, nor there.

saagarjha 6y ago

Sure, but I picked that specifically because it seemed to be what the parent comment was talking about.

coldtea 6y ago
Is there any automatic way to tell your software apart from malware? Because that's part of what this mechanism tries to provide...
- saagarjha 6y ago
  In theory no, that's impossible. In practice, I publish checksums on my website and people trust that I am not malicious.
  - FabHK 6y ago
    The thing is, your friendly scammer could also publish checksums on their website. It is clear to you that you're writing fine open source software, not malware. But how is the consumer supposed to tell? If people trust you, why bother with the checksums? (Over HTTPS, the downloaded content cannot be tampered with. If someone tampered with the content on your website, or performs a MITM, they can also replace the checksums.)
    - saagarjha 6y ago
      The checksums are there if they happen to grab the binary in some way that is not "using HTTPS directly from my website" and they'd like to check. Why do the know I'm not writing malware? Trust in my software, mostly? It is unclear that notarization actually stops malware–Apple has failed to explain how it helps, but enforces it by decree.
      - rmrfrmrf 6y ago
        Pretty easy to figure out what's going on: 1. You submit your app bundle and your credentials to Apple for notarization. 2. Apple records your information and goes through each library, framework, and your code, checking the code signing info and "fingerprint" of each for known malware. 3. Apple issues the ticket for stapling to the app bundle. Now say, for example, that libffmpeg-0.1.2-beta2.dylib is found to mine cryptocurrency: 1. Apple goes through their database and finds the app where the malware was reported. 2. Apple marks that fingerprint as malicious. 3. Apple now flags any other apps that use libffmpeg-0.1.2-beta2.dylib (by checking the fingerprint) and disables any versions of any app running that version. Additionally, any other attempts to notarize apps with the malicious dylib are rejected. Notarization provides 2 major benefits for devs that I can see: 1. Apple doesn't need to revoke your entire certificate just to block one version of an app. 2. Apple's audit trail of who notarized the app (and from where) prevents cases where stolen credentials result in a DoS of the victim (e.g. your account being locked, your name and address permabanned, and funds frozen).
        thw0rted 6y ago
        I'd be interested to see the track record since they implemented notarization. How often has it caught malware, both before and after the fact? I haven't seen any headlines about e.g. a popular application failing to launch one day because Apple found a miner in it some time after initial notarization.
        saagarjha 6y ago
        Why can’t Apple just push that through XProtect?
        jolux 6y ago
        Why not do both?
        saagarjha 6y ago
        Because notarization has the very concrete downside of costing money to do, plus the fuzzier steps of it being a fairly complicated and often picky/opaque process to have to deal with when shipping your software.
  - mistersquid 6y ago
    > I publish checksums on my website and people trust that I am not malicious. Users who know how to verify checksums know how to work around unnotarized Mac apps.
    - mcv 6y ago
      It would be nice if the OS automatically verified these checksums. That would have been a nice OS X feature, but instead Apple ignores the verification process that already exists and invents their own, with themselves in control.
      - coldtea 6y ago
        >with themselves in control. That's the whole idea to protect from malware. You don't want the software publisher (which could just as well be a malware publisher) in control.
  - Cthulhu_ 6y ago
    I'd rather also have a party in whose interest it is to not get malware on their operating system confirm your claim that your software doesn't contain malware.
  - coldtea 6y ago
    >In theory no, that's impossible It's impossible in the general "is this file malware?" case. It's totally possible in the "is this file a copy of known malware?" case.
- enriquto 6y ago
  > Is there any automatic way to tell your software apart from malware? There is no universally agreed-upon definition of malware. One man's operating system is another man's malware. For me, an operating system that "calls home" for each new executable you compile is a crystal clear case of malware. In the case of this article, then, the only malware in question is macOS.
  - saagarjha 6y ago
    Plus like this little thing by a guy named Turing…
    - Hackbraten 6y ago
      If an Apple engineer were to compile a variant of Apple’s notarization algorithm where ok means no and no means ok, would the resulting binary notarize its own source fed into it?
      - coldtea 6y ago
        Well, if the mechanism is e.g. a blacklist of APIs that shouldn't be used, and a blacklist of known malware hashes (as is the case), then Apple's "is this malware" routine could trivially print "no" for itself. Sorry to the grandparent, but this is nothing like the halting problem...
        saagarjha 6y ago
        This already exists and it is called XProtect. My question through these threads has been "why does notarization exist" and I am still trying to understand why it does, because every answer I have been given simplifies down to "here is a reason that it should exist…wait, that's just what code signing or Apple's built-in MRT does already".
  - coldtea 6y ago
    >There is no universally agreed-upon definition of malware. Doesn't have to be. Just the common user's definition is OK. >For me, an operating system that "calls home" for each new executable you compile is a crystal clear case of malware. In the case of this article, then, the only malware in question is macOS. Which is neither here, nor there.