3 ms·
It also might be tough to run as a business because it's quite possible the first time you sign someone else's malware, Apple's going to revoke the notarization
by moduspol 6y ago
It also might be tough to run as a business because it's quite possible the first time you sign someone else's malware, Apple's going to revoke the notarization of all the apps you've signed (which would be for other paying customers).
Not to mention it undermines the purpose of notarization, so if it became popular enough they'd probably just squash it.
- usrusr 6y agoThat would be true for rubberstamping-as-a-service, a weaker version of running a rogue CA. But project maintainers getting themselves an Apple ID and recouping that cost + x (hopefully) via non-gratis signed binaries wouldn't have that problem at all. Or of they did (malware sneaking into their artifacts), a lost Apple ID should be the least of their concerns. There'd even be a conceivable but unlikely scenario where some automated scan deep inside the Apple publishing pipeline would detect an otherwise undetected malware intrusion in some upstream dependency or badly vetted commit and thereby indirectly protecting the users of the unsigned copy, by acting as a canary.