3 ms·
To the average user, yes, but Apple can see the chain of trust and can do the data science required to figure out who signed what. You better believe that in th
by nikisweeting 6y ago
To the average user, yes, but Apple can see the chain of trust and can do the data science required to figure out who signed what. You better believe that in the even of a large scale malware distribution via signed binaries, they're going to be revoking those certs and tracking down the accounts responsible (like after the VLC website hack).
- Spivak 6y agoThe data science to find out who ran md5sum on their binary?
- nikisweeting 6y ago> The notary service maintains an audit trail of the software distributed using your signing key. If you discover unauthorized versions of your software, you can work with Apple to revoke the tickets associated with those versions. https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/xcode/notarizing_m...
- plorkyeran 6y agoThere is no certificate involved in ad-hoc code signing. It's just a hash with no identity or chain of trust involved.
- nikisweeting 6y agoYes but "ad-hoc" code signing is almost useless on its own on macOS, it almost always goes with notarization, which does require a revokable certificate with a chain of trust attached to a Developer ID for the initial code sign. > You can only notarize apps that you sign with a Developer ID certificate. If you use any other certificate — like a Mac App Distribution certificate, or a self-signed certificate — notarization fails with the following message: "The binary is not signed with a valid Developer ID certificate." https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/xcode/notarizing_m... https://developer.apple.com/library/archive/technotes/tn2206/_index.html https://developer.apple.com/library/archive/technotes/tn2206...