5 ms·

We don't need to speculate, the Certification Practice Statement is here: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf http

by _qulr 6y ago

We don't need to speculate, the Certification Practice Statement is here: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve... See section 4.8 in particular. "The Subscriber may initiate a revocation request by sending an email to product-security@apple.com. The request for revocation will then be evaluated by Apple."

jlgaddis 6y ago
I was speculating because I'm not personally familiar with this specific program. If the issuing CA is subject to the CABF's Code Signing Baseline Requirements, then Apple "MUST" revoke the certificate "within one business day". My point, again, was that such a request is NOT "unusual" and an issuing CA complying with such a request is NOT "inexplicable". -- EDIT: Per the CABF's "Code Signing Certificate Working Group Charter" [0]: > Other functional models include those which allow developers to self-sign code and those in which the platform supplier manages the code signing or certificate issuance process, and these models are expressly excluded from the working group’s mandate. Common examples of these models that are expressly excluded from the scope of guidelines to be promulgated by the working group are Apple’s Developer ID program and Google’s Android. [0]: https://cabforum.org/2019/03/26/code-signing-certificate-wg-charter/ https://cabforum.org/2019/03/26/code-signing-certificate-wg-...
- _qulr 6y ago
  > My point, again, was that such a request is NOT "unusual" That depends on what "unusual" means. The only good reason for a developer to request their cert be revoked by Apple is if the private key is compromised, in which case Apple should definitely grant the request. Otherwise, there's no reason.
  - olliej 6y ago
    It could be change in ownership of the company, firing an employee who had access, or even just basic housekeeping if you've got an unused key that would let someone sign software in a way that makes it look official, then that is an attack vector. Why leave it open if you don't need to. Revocation is not unusual or uncommon for a CA. For an individual developer it might seem uncommon, but uncommon * large number of certs == common.
    - _qulr 6y ago
      I don't think this fully appreciates the consequences of revoking a Developer ID code signing certificate. If a Developer ID cert is revoked, then all software ever signed with that cert is disabled on every Mac in the world, as soon as the Mac checks OCSP, which is likely to be the next time the software is launched. Revoking a Developer ID cert is a death sentence for signed software. Thus, basic housekeeping is not a justified reason for revoking a certificate. The express purpose of the Developer ID program was for security, and security is the only reason to revoke a Developer ID certificate. It's an extreme measure, to be taken only in the worst case scenario. Apple has a remote kill switch for all signed software on the Mac. They need to be extremely careful about when, if ever, they flip that switch. Almost all known cases of a Developer ID cert getting revoked is when the owner of the cert was a malware author.
      - olliej 6y ago
        Software developers have the remote kill switch as well, and they used it this time. Apple did nothing wrong, unless you’re of the opinion that Apple should be auditing other company’s internal policies and controls.
        _qulr 6y ago
        > Software developers have the remote kill switch as well, and they used it this time. How so? They can't unilaterally revoke a Developer ID cert, they can only request that Apple revoke it. > Apple did nothing wrong, unless you’re of the opinion that Apple should be auditing other company’s internal policies and controls. This is missing the point of Developer ID. It's a program created by Apple and imposed as a requirement on Mac developers. The purpose of the Developer ID cert is to prevent malware. That's why it has a remote kill switch, to stop malware from running. The purpose was not to give Mac developers a remote kill switch to use however they please. Why in the world would Apple do that? Developer ID is not an "internal policy" for third party developers. There's nothing to audit. Developer ID is Apple's program, designed for Apple's purposes, and Apple makes the decision whether or not to revoke the certs. Almost all known Developer ID certificate revocations are not the result of the developer's own request but rather the result of Apple discovering malware in the wild and revoking the certs of the malware authors.
pseudalopex 6y ago
They have a web page too.

by _qulr 6y ago

jlgaddis 6y ago

I was speculating because I'm not personally familiar with this specific program. If the issuing CA is subject to the CABF's Code Signing Baseline Requirements, then Apple "MUST" revoke the certificate "within one business day". My point, again, was that such a request is NOT "unusual" and an issuing CA complying with such a request is NOT "inexplicable". -- EDIT: Per the CABF's "Code Signing Certificate Working Group Charter" [0]: > Other functional models include those which allow developers to self-sign code and those in which the platform supplier manages the code signing or certificate issuance process, and these models are expressly excluded from the working group’s mandate. Common examples of these models that are expressly excluded from the scope of guidelines to be promulgated by the working group are Apple’s Developer ID program and Google’s Android. [0]: https://cabforum.org/2019/03/26/code-signing-certificate-wg-charter/ https://cabforum.org/2019/03/26/code-signing-certificate-wg-...

_qulr 6y ago
> My point, again, was that such a request is NOT "unusual" That depends on what "unusual" means. The only good reason for a developer to request their cert be revoked by Apple is if the private key is compromised, in which case Apple should definitely grant the request. Otherwise, there's no reason.
- olliej 6y ago
  It could be change in ownership of the company, firing an employee who had access, or even just basic housekeeping if you've got an unused key that would let someone sign software in a way that makes it look official, then that is an attack vector. Why leave it open if you don't need to. Revocation is not unusual or uncommon for a CA. For an individual developer it might seem uncommon, but uncommon * large number of certs == common.
  - _qulr 6y ago
    I don't think this fully appreciates the consequences of revoking a Developer ID code signing certificate. If a Developer ID cert is revoked, then all software ever signed with that cert is disabled on every Mac in the world, as soon as the Mac checks OCSP, which is likely to be the next time the software is launched. Revoking a Developer ID cert is a death sentence for signed software. Thus, basic housekeeping is not a justified reason for revoking a certificate. The express purpose of the Developer ID program was for security, and security is the only reason to revoke a Developer ID certificate. It's an extreme measure, to be taken only in the worst case scenario. Apple has a remote kill switch for all signed software on the Mac. They need to be extremely careful about when, if ever, they flip that switch. Almost all known cases of a Developer ID cert getting revoked is when the owner of the cert was a malware author.
    - olliej 6y ago
      Software developers have the remote kill switch as well, and they used it this time. Apple did nothing wrong, unless you’re of the opinion that Apple should be auditing other company’s internal policies and controls.
      - _qulr 6y ago
        > Software developers have the remote kill switch as well, and they used it this time. How so? They can't unilaterally revoke a Developer ID cert, they can only request that Apple revoke it. > Apple did nothing wrong, unless you’re of the opinion that Apple should be auditing other company’s internal policies and controls. This is missing the point of Developer ID. It's a program created by Apple and imposed as a requirement on Mac developers. The purpose of the Developer ID cert is to prevent malware. That's why it has a remote kill switch, to stop malware from running. The purpose was not to give Mac developers a remote kill switch to use however they please. Why in the world would Apple do that? Developer ID is not an "internal policy" for third party developers. There's nothing to audit. Developer ID is Apple's program, designed for Apple's purposes, and Apple makes the decision whether or not to revoke the certs. Almost all known Developer ID certificate revocations are not the result of the developer's own request but rather the result of Apple discovering malware in the wild and revoking the certs of the malware authors.

pseudalopex 6y ago

They have a web page too.