5 ms·

> Apple’s anti-malware system was actually just working exactly as designed. That's an interesting take, considering that there was no malware involved, and ma

• olliej 6y ago
  It was an invalid signing certificate. One of the major reasons to revoke a certificate is that the private key is compromised. Hence anything signed with an explicitly revoked cert must be blocked.
  • _qulr 6y ago
    > One of the major reasons to revoke a certificate is that the private key is compromised. The private key was not compromised. The proof of this is that Apple un-revoked the very same certificate. The cert is valid again.
    • simonh 6y ago
      That’s really not how private keys work. If I had stolen a copy of the private key, or if HP published it on their web site, un-revoking the certificate would still work fine.
      • _qulr 6y ago
        > un-revoking the certificate would still work fine It's not a question of whether it would "work". If the private key was out in the wild, then Apple would never un-revoke the cert. That would be insane, because anyone could sign software with it.
        • simonh 6y ago
          They wouldn’t necessarily know.
          • _qulr 6y ago
            Why wouldn't they know? It seems that some people want to claim that Apple has to act based on a single email and is incapable of replying to that email or calling on the phone, when Apple has the phone # of every registered developer.
            • simonh 6y ago
              How could Apple possibly know for sure whether HP had actually lost a key or not? All they have to go on is what HP tells them. Anyway this could have nothing to do with key security. Apple gets certificate revocation requests all the time, to disable test builds, disabled badly bugged software versions, to disable software for licensing reasons. It’s the developer’s choice when or if they revoke a cert. Do you have any evidence this request was different enough to require escalated investigation compared to any other routine request? HP doesn’t seem to think it was.
              • _qulr 6y ago
                > Apple gets certificate revocation requests all the time, to disable test builds, disabled badly bugged software versions, to disable software for licensing reasons. How do you know this? What is the evidence for this claim? The strange thing about this claim is that certificate revocation does not disable specific builds, it disabled every piece of software ever signed with the cert, so this wouldn't even accomplish what you claim it accomplishes.
                • deleted 6y ago
                  [deleted]
                • simonh 6y ago
                  You just sign different builds with different certs. That’s how come this revocation only disabled particular HP drivers, not ever piece of software for the Mac released by HP.
                  • 6y ago
• Xylakant 6y ago
  HP, the author of the software in question explicitly revoked the certificate, indicating that they no longer trust that the software they signed with it is secure. Yes, HP may have done that in error, but how can apple know or reasonably assume an error here and retain trust? No actual malware ot breach was involved in this case, but what is the system supposed to do if the org responsible for the software revokes the trust anchor? Continue just as if trust was still established? What if the certificate had actually been used to distribute malware? The system worked as designed, but HP needs to figure out how that to revocation happened.
  • _qulr 6y ago
    > HP, the author of the software in question explicitly revoked the certificate HP cannot revoke the cert. Only the CA, Apple, can revoke the cert. HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request. See section 4.8 on certificate revocation: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve...
    • JumpCrisscross 6y ago
      > HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request This is a security-usability tradeoff. Do you eagerly grant revocations, in the process protecting more users in cases of disaster but exposing yourself to the pain of false positives (like this one)? Or do you verify such requests, thereby making accidental revocations unlikely but increasing the time it takes for compromised software to get pulled? Given revocation is more easily reversed than fixing a compromised computer, I stand with Apple’s decision to revoke first and ask questions later. But this is a preference, nothing more. Based on how Apple has positioned itself with respect to privacy and security, I imagine this is not an uncommon preference among its customers.
      • _qulr 6y ago
        > I stand with Apple’s decision to revoke first and ask questions later. There are only 2 reasons to revoke a code signing certificate: 1) The private key is compromised. 2) The owner of the certificate is signing malware. Obviously HP is not a malware author, so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. There aren't questions, plural, there's only one question.