4 ms·

With both Windows and MacOS both putting scary warnings and hard to bypass blocking methods on improperly signed software this could eventually lead to develope

by xacky 6y ago

With both Windows and MacOS both putting scary warnings and hard to bypass blocking methods on improperly signed software this could eventually lead to developers being ransomed, “pay us big money or we will revoke your certificate”. This is not the only incident like this.

t0mas88 6y ago
That would also be possible for a successful website or app using pinning. So far there are no public reports of it happening. Would probably also put the CA out of business in no time if they did.
- joshspankit 6y ago
  For now. It’s very easy to see two steps ahead on this
gruez 6y ago
>this could eventually lead to developers being ransomed, “pay us big money or we will revoke your certificate” by whom? the platform makers (apple/microsoft) or malicious third parties?
- phreack 6y ago
  Apple is effectively doing this to Epic and others, but it could be done by any agreement of enough CA's as well.
  - EricE 6y ago
    Epic violated the agreements they signed with Apple. Whether or not we care for the contents of the agreements is a separate issue. Apple did not capriciously act against Epic - if they had then Epic wouldn’t have had an advertising campaign and lawsuit ready to go within hours. The situation with WinRAR is completely different and it doesn’t help anything in trying to conflate the two; indeed it just muddies the waters :(
    - joshspankit 6y ago
      I’d argue that it’s more similar than it seems, but with one caveat: Apple (rightfully) became the market leader, but is essentially running what should be a public market. If one company took over all the physical land on the planet, and had everyone sign agreements to essentially pay taxes to them with every transaction, would we still argue that that’s not only legal, but morally justified?
      - a1369209993 6y ago
        > If one company took over all the physical land [in a prohibitively large area], and had everyone sign agreements to essentially pay taxes to them [...] that [that is] legal Well, that's basically the definition of a country, so... Edit: countries tend to define what is legal.
        joshspankit 6y ago
        so... ...?
      - Razengan 6y ago
        It’s funny that when Android needs to prove its superiority during some arguments it’s the market leader, but when Apple needs to be flagged for a monopoly they’re the market leader.
      - waste_monk 6y ago
        >Apple (rightfully) became the market leader, but is essentially running what should be a public market. They became the market leader (and I say this as an Android person who dislikes Apple and would never own one) because it's not a public market - they offer a "premium" experience, and part of that is the heavily curated app store. Opening up the platform would undermine the whole reason why it's popular to begin with. As long as you aren't using a jailbroken device (and there aren't any current 0-day attacks, which are rare) you don't have to worry about downloading random malware or side-loading something nasty. Not to mention that it would prevent Apple from enforcing things like sign-in with apple ID, which again reduces user convenience and undermines the reason apple products are popular in the first place. People buy Apple devices because they "Just Work" and are willing to trade away control of the device to get that convenience - there's no real difference between an iPhone and a flagship Samsung phone (for example) in terms of hardware quality, it's all about slickness and ease of use. >If one company took over all the physical land on the planet, and had everyone sign agreements to essentially pay taxes to them with every transaction, would we still argue that that’s not only legal, but morally justified? Do you not believe there is a significant ongoing cost relating to the Apple store? Bandwidth, storage, CDN, power and HVAC for equipment, other building / data centre costs, IT staff for maintaining the servers and services, developers to develop the store and maintain Apple's side of the arms race between malicious devs trying to fool Apple's automated checking and Apple trying to detect and prevent malicious apps being uploaded, other miscellaneous overheads (accounting, auditors, etc.)... why should they be prevented from collecting taxes to cover the costs? I'm sure it would be profitable for Apple to some degree, but not nearly as much as people seem to believe - IIRC something like two billion iPhones (not sure if that includes other iOS devices or just the phones) of various makes have been produced, and almost all of those will have checked in regularly to the store for updates and installing new stuff over the course of the devices lifetime - how much bandwidth do you think that would use? Apparently the (ballpark) storage on a device consumed by an install of fortnite on iOS is around 8GB, multiplied by 100 million downloads... That would not all be concurrent and earlier install would have been lighter, and how much of that comes through Apple vs. Epic's own CDN I do not know (e.g. if they can distribute game content themselves), but in any case I'm sure it is still a massive load on the store IX. I hate to rant like this but the whole "ApPlE gReEdY" argument with no consideration of the costs involved is really irritating, and I've been seeing it everywhere since the dispute over Fortnite kicked off - I don't know the actual figures but I'm sure there are massive ongoing costs involved in running the Apple store. Putting a significant burden on that infrastructure and then complaining when you get kicked off for not contributing to it is an incredible display of gall on Epic's part.
- izacus 6y ago
  Both. We've seen third parties do this on Windows and Apple themselves use this to punish developers who dared criticize them.
  - Razengan 6y ago
    Source? When have “we” seen that?
  - Karunamon 6y ago
    Where and when did Microsoft or Apple yank someone's developer cert for the sole reason of criticism? An accusation that serious needs to be substantiated.
renewiltord 6y ago
A non-problem. Linux will run on x86 hardware till the end of time.
- kube-system 6y ago
  Professional developers have to write code that runs on their customers' systems.
  - renewiltord 6y ago
    The customers have a VM for this that will be likely delivered indefinitely for this purpose: Webkit + friends.
    - kube-system 6y ago
      There’s a lot of parts and peripherals of a computer you can’t touch from inside of that VM. The vast majority, really.
      - renewiltord 6y ago
        That's fair. If you have specialized needs, you might be in trouble. Users clearly prefer to exclude people with specialized needs so I now understand why you are worried.
- dependenttypes 6y ago
  Linux dropped support for i386 not too long ago. Older versions of x86 are not supported either.

by xacky 6y ago

t0mas88 6y ago

That would also be possible for a successful website or app using pinning. So far there are no public reports of it happening. Would probably also put the CA out of business in no time if they did.

joshspankit 6y ago
For now. It’s very easy to see two steps ahead on this

gruez 6y ago

>this could eventually lead to developers being ransomed, “pay us big money or we will revoke your certificate” by whom? the platform makers (apple/microsoft) or malicious third parties?

phreack 6y ago
Apple is effectively doing this to Epic and others, but it could be done by any agreement of enough CA's as well.
- EricE 6y ago
  Epic violated the agreements they signed with Apple. Whether or not we care for the contents of the agreements is a separate issue. Apple did not capriciously act against Epic - if they had then Epic wouldn’t have had an advertising campaign and lawsuit ready to go within hours. The situation with WinRAR is completely different and it doesn’t help anything in trying to conflate the two; indeed it just muddies the waters :(
  - joshspankit 6y ago
    I’d argue that it’s more similar than it seems, but with one caveat: Apple (rightfully) became the market leader, but is essentially running what should be a public market. If one company took over all the physical land on the planet, and had everyone sign agreements to essentially pay taxes to them with every transaction, would we still argue that that’s not only legal, but morally justified?
    - a1369209993 6y ago
      > If one company took over all the physical land [in a prohibitively large area], and had everyone sign agreements to essentially pay taxes to them [...] that [that is] legal Well, that's basically the definition of a country, so... Edit: countries tend to define what is legal.
      - joshspankit 6y ago
        so... ...?
    - Razengan 6y ago
      It’s funny that when Android needs to prove its superiority during some arguments it’s the market leader, but when Apple needs to be flagged for a monopoly they’re the market leader.
    - waste_monk 6y ago
      >Apple (rightfully) became the market leader, but is essentially running what should be a public market. They became the market leader (and I say this as an Android person who dislikes Apple and would never own one) because it's not a public market - they offer a "premium" experience, and part of that is the heavily curated app store. Opening up the platform would undermine the whole reason why it's popular to begin with. As long as you aren't using a jailbroken device (and there aren't any current 0-day attacks, which are rare) you don't have to worry about downloading random malware or side-loading something nasty. Not to mention that it would prevent Apple from enforcing things like sign-in with apple ID, which again reduces user convenience and undermines the reason apple products are popular in the first place. People buy Apple devices because they "Just Work" and are willing to trade away control of the device to get that convenience - there's no real difference between an iPhone and a flagship Samsung phone (for example) in terms of hardware quality, it's all about slickness and ease of use. >If one company took over all the physical land on the planet, and had everyone sign agreements to essentially pay taxes to them with every transaction, would we still argue that that’s not only legal, but morally justified? Do you not believe there is a significant ongoing cost relating to the Apple store? Bandwidth, storage, CDN, power and HVAC for equipment, other building / data centre costs, IT staff for maintaining the servers and services, developers to develop the store and maintain Apple's side of the arms race between malicious devs trying to fool Apple's automated checking and Apple trying to detect and prevent malicious apps being uploaded, other miscellaneous overheads (accounting, auditors, etc.)... why should they be prevented from collecting taxes to cover the costs? I'm sure it would be profitable for Apple to some degree, but not nearly as much as people seem to believe - IIRC something like two billion iPhones (not sure if that includes other iOS devices or just the phones) of various makes have been produced, and almost all of those will have checked in regularly to the store for updates and installing new stuff over the course of the devices lifetime - how much bandwidth do you think that would use? Apparently the (ballpark) storage on a device consumed by an install of fortnite on iOS is around 8GB, multiplied by 100 million downloads... That would not all be concurrent and earlier install would have been lighter, and how much of that comes through Apple vs. Epic's own CDN I do not know (e.g. if they can distribute game content themselves), but in any case I'm sure it is still a massive load on the store IX. I hate to rant like this but the whole "ApPlE gReEdY" argument with no consideration of the costs involved is really irritating, and I've been seeing it everywhere since the dispute over Fortnite kicked off - I don't know the actual figures but I'm sure there are massive ongoing costs involved in running the Apple store. Putting a significant burden on that infrastructure and then complaining when you get kicked off for not contributing to it is an incredible display of gall on Epic's part.
izacus 6y ago
Both. We've seen third parties do this on Windows and Apple themselves use this to punish developers who dared criticize them.
- Razengan 6y ago
  Source? When have “we” seen that?
- Karunamon 6y ago
  Where and when did Microsoft or Apple yank someone's developer cert for the sole reason of criticism? An accusation that serious needs to be substantiated.

renewiltord 6y ago

A non-problem. Linux will run on x86 hardware till the end of time.

kube-system 6y ago
Professional developers have to write code that runs on their customers' systems.
- renewiltord 6y ago
  The customers have a VM for this that will be likely delivered indefinitely for this purpose: Webkit + friends.
  - kube-system 6y ago
    There’s a lot of parts and peripherals of a computer you can’t touch from inside of that VM. The vast majority, really.
    - renewiltord 6y ago
      That's fair. If you have specialized needs, you might be in trouble. Users clearly prefer to exclude people with specialized needs so I now understand why you are worried.
dependenttypes 6y ago
Linux dropped support for i386 not too long ago. Older versions of x86 are not supported either.