3 ms·

> I stand with Apple’s decision to revoke first and ask questions later. There are only 2 reasons to revoke a code signing certificate: 1) The private key is

by _qulr 6y ago

> I stand with Apple’s decision to revoke first and ask questions later. There are only 2 reasons to revoke a code signing certificate: 1) The private key is compromised. 2) The owner of the certificate is signing malware. Obviously HP is not a malware author, so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. There aren't questions, plural, there's only one question.

simonh 6y ago
HP said themselves they did request Apple to revoke their certificate. That’s clearly on HP. Even HP has said this was HP’s mistake.
- _qulr 6y ago
  Nobody is absolving HP. The problem is that there were 2 mistakes in this case. HP mistakenly requested that the cert be revoked, and Apple mistakenly granted the request. If Apple had said no, this problem never would have occurred.
  - pseudalopex 6y ago
    How would Apple know the private key wasn't compromised?
    - _qulr 6y ago
      This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.
      - Talanes 6y ago
        How is it stranger than ANY speculation without knowing what HP said in the e-mail?
        _qulr 6y ago
        Don't you think the lack of transparency from both the Certificate Authority (Apple) and the certificate holder (HP) is troubling? We have one brief vague statement to the press by HP, and nothing at all from Apple. Apple revoked HP's cert, which almost immediately caused all HP software signed with the cert to be disabled on every Mac in the world, and then afterward Apple has absolutely nothing to say about it?
        Talanes 6y ago
        It's definitely troubling, but without more information the truth could be anywhere from "Apple responded thoughtlessly to a request without considering what would happen" to "someone at HP accidentally sent out an e-mail they REALLY shouldn't have."
        _qulr 6y ago
        The truth could be both of those. ;-)
      - pseudalopex 6y ago
        Who says HP didn't use the web page for revoking certificates? Who says HP didn't tell Apple the key was compromised? Why wouldn't Apple assume the private key was compromised if that's the only reason a developer would request revocation?
        _qulr 6y ago
        > Who says HP didn't use the web page for revoking certificates? There's no web page for revoking Developer ID certificates. Only Apple can revoke them. I know because I have a Developer ID certificate myself, and also because Apple says so in section 4.8 of their document: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve... > Who says HP didn't tell Apple the key was compromised? Their key wasn't compromised, so why would they say this? > Why wouldn't Apple assume the private key was compromised if that's the only reason a developer would request revocation? Why would Apple assume anything? Apple can reply to the email, or call HP on the phone. (Apple has the phone # of all registered developers.)
        pseudalopex 6y ago
        The document doesn't say there isn't a web page. There at least used to be one.[1] The request had to be intentional if they had to email Apple. Whatever reason they thought they had turned out to be incorrect. [1] https://www.quora.com/How-do-I-revoke-my-Apple-Developer-certificate https://www.quora.com/How-do-I-revoke-my-Apple-Developer-cer...
        _qulr 6y ago
        The document says you have to email Apple Product Security. I also say there isn't a web page, as the owner of a Developer ID cert. That link is for an iOS Development certificate, which is under the WWDR CA, not the Developer ID CA. Compare section 4.8 of this document, which says there is a website for revoking WWDR issued certs: https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.21.pdf https://images.apple.com/certificateauthority/pdf/Apple_WWDR...
  - aw1621107 6y ago
    > Apple mistakenly granted the request Genuinely curious -- what makes you so certain that Apple granting HP's request was a mistake? Do we have information pointing towards HP providing (or failing to provide) a reason along with their request?
yladiz 6y ago
> so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. Why? If a business asked for their code signing certificate to be revoked, why shouldn’t they be able to?
- _qulr 6y ago
  Because revoking a Developer ID cert immediately (on the next OCSP check) disables all software ever signed with that cert on every Mac in the world. It's a remote kill switch. I can't emphasize enough what an extreme, last resort measure revocation is for Developer ID code signing certs.
JumpCrisscross 6y ago
> There are only 2 reasons to revoke a code signing certificate Why? Based on what? Why isn’t a third if the owner of the certificate requests revocation?
- _qulr 6y ago
  The one and only purpose of Developer ID is to prevent malware. Apple imposed the Developer ID code signing requirement on Mac developers a number of years ago. If you don't sign your Mac app with a Developer ID cert, then macOS will warn about malware and refuse to launch the app when Mac users download it. Almost all known Developer ID cert revocations have been for malware authors. These revocations are initiated by Apple, not requested by the (malware) developers. There seems to be a lot of misconceptions about Developer ID, because people are comparing them to web site certs, but Developer ID is very different. When a Developer ID cert is revoked, all software ever signed with that cert is immediately disabled on every Mac in the world. It's a remote kill switch. This kill switch is only used in extreme circumstances, such as malware distribution. The cert owner's desires are not really relevant to Apple. The cert is for malware prevention only. Some Mac developers would prefer to be able to distribute their software without Apple's permission, and balk at having to pay $99 per year to Apple for code signing, but we effectively have no choice.

by _qulr 6y ago

simonh 6y ago

HP said themselves they did request Apple to revoke their certificate. That’s clearly on HP. Even HP has said this was HP’s mistake.

_qulr 6y ago
Nobody is absolving HP. The problem is that there were 2 mistakes in this case. HP mistakenly requested that the cert be revoked, and Apple mistakenly granted the request. If Apple had said no, this problem never would have occurred.
- pseudalopex 6y ago
  How would Apple know the private key wasn't compromised?
  - _qulr 6y ago
    This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.
    - Talanes 6y ago
      How is it stranger than ANY speculation without knowing what HP said in the e-mail?
      - _qulr 6y ago
        Don't you think the lack of transparency from both the Certificate Authority (Apple) and the certificate holder (HP) is troubling? We have one brief vague statement to the press by HP, and nothing at all from Apple. Apple revoked HP's cert, which almost immediately caused all HP software signed with the cert to be disabled on every Mac in the world, and then afterward Apple has absolutely nothing to say about it?
        Talanes 6y ago
        It's definitely troubling, but without more information the truth could be anywhere from "Apple responded thoughtlessly to a request without considering what would happen" to "someone at HP accidentally sent out an e-mail they REALLY shouldn't have."
        _qulr 6y ago
        The truth could be both of those. ;-)
    - pseudalopex 6y ago
      Who says HP didn't use the web page for revoking certificates? Who says HP didn't tell Apple the key was compromised? Why wouldn't Apple assume the private key was compromised if that's the only reason a developer would request revocation?
      - _qulr 6y ago
        > Who says HP didn't use the web page for revoking certificates? There's no web page for revoking Developer ID certificates. Only Apple can revoke them. I know because I have a Developer ID certificate myself, and also because Apple says so in section 4.8 of their document: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve... > Who says HP didn't tell Apple the key was compromised? Their key wasn't compromised, so why would they say this? > Why wouldn't Apple assume the private key was compromised if that's the only reason a developer would request revocation? Why would Apple assume anything? Apple can reply to the email, or call HP on the phone. (Apple has the phone # of all registered developers.)
        pseudalopex 6y ago
        The document doesn't say there isn't a web page. There at least used to be one.[1] The request had to be intentional if they had to email Apple. Whatever reason they thought they had turned out to be incorrect. [1] https://www.quora.com/How-do-I-revoke-my-Apple-Developer-certificate https://www.quora.com/How-do-I-revoke-my-Apple-Developer-cer...
        _qulr 6y ago
        The document says you have to email Apple Product Security. I also say there isn't a web page, as the owner of a Developer ID cert. That link is for an iOS Development certificate, which is under the WWDR CA, not the Developer ID CA. Compare section 4.8 of this document, which says there is a website for revoking WWDR issued certs: https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.21.pdf https://images.apple.com/certificateauthority/pdf/Apple_WWDR...
- aw1621107 6y ago
  > Apple mistakenly granted the request Genuinely curious -- what makes you so certain that Apple granting HP's request was a mistake? Do we have information pointing towards HP providing (or failing to provide) a reason along with their request?

yladiz 6y ago

> so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. Why? If a business asked for their code signing certificate to be revoked, why shouldn’t they be able to?

_qulr 6y ago
Because revoking a Developer ID cert immediately (on the next OCSP check) disables all software ever signed with that cert on every Mac in the world. It's a remote kill switch. I can't emphasize enough what an extreme, last resort measure revocation is for Developer ID code signing certs.

JumpCrisscross 6y ago

> There are only 2 reasons to revoke a code signing certificate Why? Based on what? Why isn’t a third if the owner of the certificate requests revocation?

_qulr 6y ago
The one and only purpose of Developer ID is to prevent malware. Apple imposed the Developer ID code signing requirement on Mac developers a number of years ago. If you don't sign your Mac app with a Developer ID cert, then macOS will warn about malware and refuse to launch the app when Mac users download it. Almost all known Developer ID cert revocations have been for malware authors. These revocations are initiated by Apple, not requested by the (malware) developers. There seems to be a lot of misconceptions about Developer ID, because people are comparing them to web site certs, but Developer ID is very different. When a Developer ID cert is revoked, all software ever signed with that cert is immediately disabled on every Mac in the world. It's a remote kill switch. This kill switch is only used in extreme circumstances, such as malware distribution. The cert owner's desires are not really relevant to Apple. The cert is for malware prevention only. Some Mac developers would prefer to be able to distribute their software without Apple's permission, and balk at having to pay $99 per year to Apple for code signing, but we effectively have no choice.