6 ms·

HP, the author of the software in question explicitly revoked the certificate, indicating that they no longer trust that the software they signed with it is sec

HP, the author of the software in question explicitly revoked the certificate, indicating that they no longer trust that the software they signed with it is secure. Yes, HP may have done that in error, but how can apple know or reasonably assume an error here and retain trust? No actual malware ot breach was involved in this case, but what is the system supposed to do if the org responsible for the software revokes the trust anchor? Continue just as if trust was still established? What if the certificate had actually been used to distribute malware? The system worked as designed, but HP needs to figure out how that to revocation happened.

_qulr 6y ago
> HP, the author of the software in question explicitly revoked the certificate HP cannot revoke the cert. Only the CA, Apple, can revoke the cert. HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request. See section 4.8 on certificate revocation: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve...
- JumpCrisscross 6y ago
  > HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request This is a security-usability tradeoff. Do you eagerly grant revocations, in the process protecting more users in cases of disaster but exposing yourself to the pain of false positives (like this one)? Or do you verify such requests, thereby making accidental revocations unlikely but increasing the time it takes for compromised software to get pulled? Given revocation is more easily reversed than fixing a compromised computer, I stand with Apple’s decision to revoke first and ask questions later. But this is a preference, nothing more. Based on how Apple has positioned itself with respect to privacy and security, I imagine this is not an uncommon preference among its customers.
  - _qulr 6y ago
    > I stand with Apple’s decision to revoke first and ask questions later. There are only 2 reasons to revoke a code signing certificate: 1) The private key is compromised. 2) The owner of the certificate is signing malware. Obviously HP is not a malware author, so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. There aren't questions, plural, there's only one question.
    - simonh 6y ago
      HP said themselves they did request Apple to revoke their certificate. That’s clearly on HP. Even HP has said this was HP’s mistake.
      - _qulr 6y ago
        Nobody is absolving HP. The problem is that there were 2 mistakes in this case. HP mistakenly requested that the cert be revoked, and Apple mistakenly granted the request. If Apple had said no, this problem never would have occurred.
        pseudalopex 6y ago
        How would Apple know the private key wasn't compromised?
        _qulr 6y ago
        This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.
        Talanes 6y ago
        How is it stranger than ANY speculation without knowing what HP said in the e-mail?
        6y ago
- simonh 6y ago
  You think there’s no reason for Apple to grant a request, which Apple requires developers to do under various circumstances. What do you thing this system, set up by Apple, for developers to make these requests to Apple, is for of not for Apple to action the requests?
  - _qulr 6y ago
    It's not really various circumstances, it's one circumstance: when the private key is compromised. That's why developers email Apple Product Security. It's a security issue. If there's no security issue, then the cert should not be revoked.
    - simonh 6y ago
      That is not true, there can be many reasons a developer might want a certificate revoked. One might be to disable test builds of software distributed to users once the final version is released. Another might be if there is a serious bug or security vulnerability in a release to force users to either down grade to a known good version or upgrade to a fixed version. Yet another might be because a license agreement for a third party software library or component in an application expired and the developer is required to disable versions of their software containing the licences component. I’m sure there’s are others. None of these are any of Apple’s business and the developer might not want to reveal the reason to a Apple for liability, confidentiality or other reasons but Apple has offered this service to their developer customers and committed to an agreed process which HP says that HP followed.
      - _qulr 6y ago
        > Apple has offered this service to their developer customers This is unfortunately a complete misunderstanding of Developer ID. The program isn't a "service" for developers, it was imposed on developers as a requirement for security purposes. We can't opt out! The intent of Developer ID is to allow Apple to remotely disable malware. That's the one and only purpose. Almost all publicly known Developer ID cert revocations were for malware authors. When a Developer ID cert is revoked, every piece of software ever signed with the cert is disabled on every Mac in the world. Revocation cannot be used to disable specific builds. Moreover, Apple has never used Developer ID for the purposes you claim it is used. You're just making up stuff with no evidence. It's clear you're not a Mac developer yourself, and you're just speculating about what you believe might be true, but you don't have any first hand knowledge of the situation. It's truly astonishing to me, as one of the few or maybe only people in this thread who is actually a Mac developer and has a Developer ID cert, that I'm getting systematically downvoted by people who have no direct knowledge of Developer ID. Getting tired of this, and HN entirely. It's incredibly discouraging, and makes me not want to be on HN when people with expertise are downvoted by people without. I've been a professional Mac developer for over a dozen years. I was around before Developer ID was introduced, before code signing was introduced. I was around for the announcement of Developer ID. I've been distributing Mac software for all these years, I know what I'm talking about.

_qulr 6y ago

> HP, the author of the software in question explicitly revoked the certificate HP cannot revoke the cert. Only the CA, Apple, can revoke the cert. HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request. See section 4.8 on certificate revocation: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve...

JumpCrisscross 6y ago
> HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request This is a security-usability tradeoff. Do you eagerly grant revocations, in the process protecting more users in cases of disaster but exposing yourself to the pain of false positives (like this one)? Or do you verify such requests, thereby making accidental revocations unlikely but increasing the time it takes for compromised software to get pulled? Given revocation is more easily reversed than fixing a compromised computer, I stand with Apple’s decision to revoke first and ask questions later. But this is a preference, nothing more. Based on how Apple has positioned itself with respect to privacy and security, I imagine this is not an uncommon preference among its customers.
- _qulr 6y ago
  > I stand with Apple’s decision to revoke first and ask questions later. There are only 2 reasons to revoke a code signing certificate: 1) The private key is compromised. 2) The owner of the certificate is signing malware. Obviously HP is not a malware author, so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. There aren't questions, plural, there's only one question.
  - simonh 6y ago
    HP said themselves they did request Apple to revoke their certificate. That’s clearly on HP. Even HP has said this was HP’s mistake.
    - _qulr 6y ago
      Nobody is absolving HP. The problem is that there were 2 mistakes in this case. HP mistakenly requested that the cert be revoked, and Apple mistakenly granted the request. If Apple had said no, this problem never would have occurred.
      - pseudalopex 6y ago
        How would Apple know the private key wasn't compromised?
        _qulr 6y ago
        This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.
        Talanes 6y ago
        How is it stranger than ANY speculation without knowing what HP said in the e-mail?
        6y ago
simonh 6y ago
You think there’s no reason for Apple to grant a request, which Apple requires developers to do under various circumstances. What do you thing this system, set up by Apple, for developers to make these requests to Apple, is for of not for Apple to action the requests?
- _qulr 6y ago
  It's not really various circumstances, it's one circumstance: when the private key is compromised. That's why developers email Apple Product Security. It's a security issue. If there's no security issue, then the cert should not be revoked.
  - simonh 6y ago
    That is not true, there can be many reasons a developer might want a certificate revoked. One might be to disable test builds of software distributed to users once the final version is released. Another might be if there is a serious bug or security vulnerability in a release to force users to either down grade to a known good version or upgrade to a fixed version. Yet another might be because a license agreement for a third party software library or component in an application expired and the developer is required to disable versions of their software containing the licences component. I’m sure there’s are others. None of these are any of Apple’s business and the developer might not want to reveal the reason to a Apple for liability, confidentiality or other reasons but Apple has offered this service to their developer customers and committed to an agreed process which HP says that HP followed.
    - _qulr 6y ago
      > Apple has offered this service to their developer customers This is unfortunately a complete misunderstanding of Developer ID. The program isn't a "service" for developers, it was imposed on developers as a requirement for security purposes. We can't opt out! The intent of Developer ID is to allow Apple to remotely disable malware. That's the one and only purpose. Almost all publicly known Developer ID cert revocations were for malware authors. When a Developer ID cert is revoked, every piece of software ever signed with the cert is disabled on every Mac in the world. Revocation cannot be used to disable specific builds. Moreover, Apple has never used Developer ID for the purposes you claim it is used. You're just making up stuff with no evidence. It's clear you're not a Mac developer yourself, and you're just speculating about what you believe might be true, but you don't have any first hand knowledge of the situation. It's truly astonishing to me, as one of the few or maybe only people in this thread who is actually a Mac developer and has a Developer ID cert, that I'm getting systematically downvoted by people who have no direct knowledge of Developer ID. Getting tired of this, and HN entirely. It's incredibly discouraging, and makes me not want to be on HN when people with expertise are downvoted by people without. I've been a professional Mac developer for over a dozen years. I was around before Developer ID was introduced, before code signing was introduced. I was around for the announcement of Developer ID. I've been distributing Mac software for all these years, I know what I'm talking about.