3 ms·

It's not really various circumstances, it's one circumstance: when the private key is compromised. That's why developers email Apple Product Security. It's a se

by _qulr 6y ago

It's not really various circumstances, it's one circumstance: when the private key is compromised. That's why developers email Apple Product Security. It's a security issue. If there's no security issue, then the cert should not be revoked.

simonh 6y ago
That is not true, there can be many reasons a developer might want a certificate revoked. One might be to disable test builds of software distributed to users once the final version is released. Another might be if there is a serious bug or security vulnerability in a release to force users to either down grade to a known good version or upgrade to a fixed version. Yet another might be because a license agreement for a third party software library or component in an application expired and the developer is required to disable versions of their software containing the licences component. I’m sure there’s are others. None of these are any of Apple’s business and the developer might not want to reveal the reason to a Apple for liability, confidentiality or other reasons but Apple has offered this service to their developer customers and committed to an agreed process which HP says that HP followed.
- _qulr 6y ago
  > Apple has offered this service to their developer customers This is unfortunately a complete misunderstanding of Developer ID. The program isn't a "service" for developers, it was imposed on developers as a requirement for security purposes. We can't opt out! The intent of Developer ID is to allow Apple to remotely disable malware. That's the one and only purpose. Almost all publicly known Developer ID cert revocations were for malware authors. When a Developer ID cert is revoked, every piece of software ever signed with the cert is disabled on every Mac in the world. Revocation cannot be used to disable specific builds. Moreover, Apple has never used Developer ID for the purposes you claim it is used. You're just making up stuff with no evidence. It's clear you're not a Mac developer yourself, and you're just speculating about what you believe might be true, but you don't have any first hand knowledge of the situation. It's truly astonishing to me, as one of the few or maybe only people in this thread who is actually a Mac developer and has a Developer ID cert, that I'm getting systematically downvoted by people who have no direct knowledge of Developer ID. Getting tired of this, and HN entirely. It's incredibly discouraging, and makes me not want to be on HN when people with expertise are downvoted by people without. I've been a professional Mac developer for over a dozen years. I was around before Developer ID was introduced, before code signing was introduced. I was around for the announcement of Developer ID. I've been distributing Mac software for all these years, I know what I'm talking about.

by _qulr 6y ago

simonh 6y ago

That is not true, there can be many reasons a developer might want a certificate revoked. One might be to disable test builds of software distributed to users once the final version is released. Another might be if there is a serious bug or security vulnerability in a release to force users to either down grade to a known good version or upgrade to a fixed version. Yet another might be because a license agreement for a third party software library or component in an application expired and the developer is required to disable versions of their software containing the licences component. I’m sure there’s are others. None of these are any of Apple’s business and the developer might not want to reveal the reason to a Apple for liability, confidentiality or other reasons but Apple has offered this service to their developer customers and committed to an agreed process which HP says that HP followed.

_qulr 6y ago
> Apple has offered this service to their developer customers This is unfortunately a complete misunderstanding of Developer ID. The program isn't a "service" for developers, it was imposed on developers as a requirement for security purposes. We can't opt out! The intent of Developer ID is to allow Apple to remotely disable malware. That's the one and only purpose. Almost all publicly known Developer ID cert revocations were for malware authors. When a Developer ID cert is revoked, every piece of software ever signed with the cert is disabled on every Mac in the world. Revocation cannot be used to disable specific builds. Moreover, Apple has never used Developer ID for the purposes you claim it is used. You're just making up stuff with no evidence. It's clear you're not a Mac developer yourself, and you're just speculating about what you believe might be true, but you don't have any first hand knowledge of the situation. It's truly astonishing to me, as one of the few or maybe only people in this thread who is actually a Mac developer and has a Developer ID cert, that I'm getting systematically downvoted by people who have no direct knowledge of Developer ID. Getting tired of this, and HN entirely. It's incredibly discouraging, and makes me not want to be on HN when people with expertise are downvoted by people without. I've been a professional Mac developer for over a dozen years. I was around before Developer ID was introduced, before code signing was introduced. I was around for the announcement of Developer ID. I've been distributing Mac software for all these years, I know what I'm talking about.