5 ms·

> HP, the author of the software in question explicitly revoked the certificate HP cannot revoke the cert. Only the CA, Apple, can revoke the cert. HP can only

by _qulr 6y ago

> HP, the author of the software in question explicitly revoked the certificate HP cannot revoke the cert. Only the CA, Apple, can revoke the cert. HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request. See section 4.8 on certificate revocation: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve...

JumpCrisscross 6y ago
> HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request This is a security-usability tradeoff. Do you eagerly grant revocations, in the process protecting more users in cases of disaster but exposing yourself to the pain of false positives (like this one)? Or do you verify such requests, thereby making accidental revocations unlikely but increasing the time it takes for compromised software to get pulled? Given revocation is more easily reversed than fixing a compromised computer, I stand with Apple’s decision to revoke first and ask questions later. But this is a preference, nothing more. Based on how Apple has positioned itself with respect to privacy and security, I imagine this is not an uncommon preference among its customers.
- _qulr 6y ago
  > I stand with Apple’s decision to revoke first and ask questions later. There are only 2 reasons to revoke a code signing certificate: 1) The private key is compromised. 2) The owner of the certificate is signing malware. Obviously HP is not a malware author, so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. There aren't questions, plural, there's only one question.
  - simonh 6y ago
    HP said themselves they did request Apple to revoke their certificate. That’s clearly on HP. Even HP has said this was HP’s mistake.
    - _qulr 6y ago
      Nobody is absolving HP. The problem is that there were 2 mistakes in this case. HP mistakenly requested that the cert be revoked, and Apple mistakenly granted the request. If Apple had said no, this problem never would have occurred.
      - pseudalopex 6y ago
        How would Apple know the private key wasn't compromised?
        _qulr 6y ago
        This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.
        Talanes 6y ago
        How is it stranger than ANY speculation without knowing what HP said in the e-mail?
        _qulr 6y ago
        Don't you think the lack of transparency from both the Certificate Authority (Apple) and the certificate holder (HP) is troubling? We have one brief vague statement to the press by HP, and nothing at all from Apple. Apple revoked HP's cert, which almost immediately caused all HP software signed with the cert to be disabled on every Mac in the world, and then afterward Apple has absolutely nothing to say about it?
        Talanes 6y ago
        It's definitely troubling, but without more information the truth could be anywhere from "Apple responded thoughtlessly to a request without considering what would happen" to "someone at HP accidentally sent out an e-mail they REALLY shouldn't have."
  - yladiz 6y ago
    > so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. Why? If a business asked for their code signing certificate to be revoked, why shouldn’t they be able to?
    - _qulr 6y ago
      Because revoking a Developer ID cert immediately (on the next OCSP check) disables all software ever signed with that cert on every Mac in the world. It's a remote kill switch. I can't emphasize enough what an extreme, last resort measure revocation is for Developer ID code signing certs.
  - JumpCrisscross 6y ago
    > There are only 2 reasons to revoke a code signing certificate Why? Based on what? Why isn’t a third if the owner of the certificate requests revocation?
    - _qulr 6y ago
      The one and only purpose of Developer ID is to prevent malware. Apple imposed the Developer ID code signing requirement on Mac developers a number of years ago. If you don't sign your Mac app with a Developer ID cert, then macOS will warn about malware and refuse to launch the app when Mac users download it. Almost all known Developer ID cert revocations have been for malware authors. These revocations are initiated by Apple, not requested by the (malware) developers. There seems to be a lot of misconceptions about Developer ID, because people are comparing them to web site certs, but Developer ID is very different. When a Developer ID cert is revoked, all software ever signed with that cert is immediately disabled on every Mac in the world. It's a remote kill switch. This kill switch is only used in extreme circumstances, such as malware distribution. The cert owner's desires are not really relevant to Apple. The cert is for malware prevention only. Some Mac developers would prefer to be able to distribute their software without Apple's permission, and balk at having to pay $99 per year to Apple for code signing, but we effectively have no choice.
simonh 6y ago
You think there’s no reason for Apple to grant a request, which Apple requires developers to do under various circumstances. What do you thing this system, set up by Apple, for developers to make these requests to Apple, is for of not for Apple to action the requests?
- _qulr 6y ago
  It's not really various circumstances, it's one circumstance: when the private key is compromised. That's why developers email Apple Product Security. It's a security issue. If there's no security issue, then the cert should not be revoked.
  - simonh 6y ago
    That is not true, there can be many reasons a developer might want a certificate revoked. One might be to disable test builds of software distributed to users once the final version is released. Another might be if there is a serious bug or security vulnerability in a release to force users to either down grade to a known good version or upgrade to a fixed version. Yet another might be because a license agreement for a third party software library or component in an application expired and the developer is required to disable versions of their software containing the licences component. I’m sure there’s are others. None of these are any of Apple’s business and the developer might not want to reveal the reason to a Apple for liability, confidentiality or other reasons but Apple has offered this service to their developer customers and committed to an agreed process which HP says that HP followed.
    - _qulr 6y ago
      > Apple has offered this service to their developer customers This is unfortunately a complete misunderstanding of Developer ID. The program isn't a "service" for developers, it was imposed on developers as a requirement for security purposes. We can't opt out! The intent of Developer ID is to allow Apple to remotely disable malware. That's the one and only purpose. Almost all publicly known Developer ID cert revocations were for malware authors. When a Developer ID cert is revoked, every piece of software ever signed with the cert is disabled on every Mac in the world. Revocation cannot be used to disable specific builds. Moreover, Apple has never used Developer ID for the purposes you claim it is used. You're just making up stuff with no evidence. It's clear you're not a Mac developer yourself, and you're just speculating about what you believe might be true, but you don't have any first hand knowledge of the situation. It's truly astonishing to me, as one of the few or maybe only people in this thread who is actually a Mac developer and has a Developer ID cert, that I'm getting systematically downvoted by people who have no direct knowledge of Developer ID. Getting tired of this, and HN entirely. It's incredibly discouraging, and makes me not want to be on HN when people with expertise are downvoted by people without. I've been a professional Mac developer for over a dozen years. I was around before Developer ID was introduced, before code signing was introduced. I was around for the announcement of Developer ID. I've been distributing Mac software for all these years, I know what I'm talking about.

by _qulr 6y ago

JumpCrisscross 6y ago

> HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request This is a security-usability tradeoff. Do you eagerly grant revocations, in the process protecting more users in cases of disaster but exposing yourself to the pain of false positives (like this one)? Or do you verify such requests, thereby making accidental revocations unlikely but increasing the time it takes for compromised software to get pulled? Given revocation is more easily reversed than fixing a compromised computer, I stand with Apple’s decision to revoke first and ask questions later. But this is a preference, nothing more. Based on how Apple has positioned itself with respect to privacy and security, I imagine this is not an uncommon preference among its customers.

_qulr 6y ago
> I stand with Apple’s decision to revoke first and ask questions later. There are only 2 reasons to revoke a code signing certificate: 1) The private key is compromised. 2) The owner of the certificate is signing malware. Obviously HP is not a malware author, so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. There aren't questions, plural, there's only one question.
- simonh 6y ago
  HP said themselves they did request Apple to revoke their certificate. That’s clearly on HP. Even HP has said this was HP’s mistake.
  - _qulr 6y ago
    Nobody is absolving HP. The problem is that there were 2 mistakes in this case. HP mistakenly requested that the cert be revoked, and Apple mistakenly granted the request. If Apple had said no, this problem never would have occurred.
    - pseudalopex 6y ago
      How would Apple know the private key wasn't compromised?
      - _qulr 6y ago
        This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.
        Talanes 6y ago
        How is it stranger than ANY speculation without knowing what HP said in the e-mail?
        _qulr 6y ago
        Don't you think the lack of transparency from both the Certificate Authority (Apple) and the certificate holder (HP) is troubling? We have one brief vague statement to the press by HP, and nothing at all from Apple. Apple revoked HP's cert, which almost immediately caused all HP software signed with the cert to be disabled on every Mac in the world, and then afterward Apple has absolutely nothing to say about it?
        Talanes 6y ago
        It's definitely troubling, but without more information the truth could be anywhere from "Apple responded thoughtlessly to a request without considering what would happen" to "someone at HP accidentally sent out an e-mail they REALLY shouldn't have."
- yladiz 6y ago
  > so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. Why? If a business asked for their code signing certificate to be revoked, why shouldn’t they be able to?
  - _qulr 6y ago
    Because revoking a Developer ID cert immediately (on the next OCSP check) disables all software ever signed with that cert on every Mac in the world. It's a remote kill switch. I can't emphasize enough what an extreme, last resort measure revocation is for Developer ID code signing certs.
- JumpCrisscross 6y ago
  > There are only 2 reasons to revoke a code signing certificate Why? Based on what? Why isn’t a third if the owner of the certificate requests revocation?
  - _qulr 6y ago
    The one and only purpose of Developer ID is to prevent malware. Apple imposed the Developer ID code signing requirement on Mac developers a number of years ago. If you don't sign your Mac app with a Developer ID cert, then macOS will warn about malware and refuse to launch the app when Mac users download it. Almost all known Developer ID cert revocations have been for malware authors. These revocations are initiated by Apple, not requested by the (malware) developers. There seems to be a lot of misconceptions about Developer ID, because people are comparing them to web site certs, but Developer ID is very different. When a Developer ID cert is revoked, all software ever signed with that cert is immediately disabled on every Mac in the world. It's a remote kill switch. This kill switch is only used in extreme circumstances, such as malware distribution. The cert owner's desires are not really relevant to Apple. The cert is for malware prevention only. Some Mac developers would prefer to be able to distribute their software without Apple's permission, and balk at having to pay $99 per year to Apple for code signing, but we effectively have no choice.

simonh 6y ago

You think there’s no reason for Apple to grant a request, which Apple requires developers to do under various circumstances. What do you thing this system, set up by Apple, for developers to make these requests to Apple, is for of not for Apple to action the requests?

_qulr 6y ago
It's not really various circumstances, it's one circumstance: when the private key is compromised. That's why developers email Apple Product Security. It's a security issue. If there's no security issue, then the cert should not be revoked.
- simonh 6y ago
  That is not true, there can be many reasons a developer might want a certificate revoked. One might be to disable test builds of software distributed to users once the final version is released. Another might be if there is a serious bug or security vulnerability in a release to force users to either down grade to a known good version or upgrade to a fixed version. Yet another might be because a license agreement for a third party software library or component in an application expired and the developer is required to disable versions of their software containing the licences component. I’m sure there’s are others. None of these are any of Apple’s business and the developer might not want to reveal the reason to a Apple for liability, confidentiality or other reasons but Apple has offered this service to their developer customers and committed to an agreed process which HP says that HP followed.
  - _qulr 6y ago
    > Apple has offered this service to their developer customers This is unfortunately a complete misunderstanding of Developer ID. The program isn't a "service" for developers, it was imposed on developers as a requirement for security purposes. We can't opt out! The intent of Developer ID is to allow Apple to remotely disable malware. That's the one and only purpose. Almost all publicly known Developer ID cert revocations were for malware authors. When a Developer ID cert is revoked, every piece of software ever signed with the cert is disabled on every Mac in the world. Revocation cannot be used to disable specific builds. Moreover, Apple has never used Developer ID for the purposes you claim it is used. You're just making up stuff with no evidence. It's clear you're not a Mac developer yourself, and you're just speculating about what you believe might be true, but you don't have any first hand knowledge of the situation. It's truly astonishing to me, as one of the few or maybe only people in this thread who is actually a Mac developer and has a Developer ID cert, that I'm getting systematically downvoted by people who have no direct knowledge of Developer ID. Getting tired of this, and HN entirely. It's incredibly discouraging, and makes me not want to be on HN when people with expertise are downvoted by people without. I've been a professional Mac developer for over a dozen years. I was around before Developer ID was introduced, before code signing was introduced. I was around for the announcement of Developer ID. I've been distributing Mac software for all these years, I know what I'm talking about.