4 ms·

This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.

by _qulr 6y ago

Talanes 6y ago
How is it stranger than ANY speculation without knowing what HP said in the e-mail?
- _qulr 6y ago
  Don't you think the lack of transparency from both the Certificate Authority (Apple) and the certificate holder (HP) is troubling? We have one brief vague statement to the press by HP, and nothing at all from Apple. Apple revoked HP's cert, which almost immediately caused all HP software signed with the cert to be disabled on every Mac in the world, and then afterward Apple has absolutely nothing to say about it?
  - Talanes 6y ago
    It's definitely troubling, but without more information the truth could be anywhere from "Apple responded thoughtlessly to a request without considering what would happen" to "someone at HP accidentally sent out an e-mail they REALLY shouldn't have."
    - _qulr 6y ago
      The truth could be both of those. ;-)
pseudalopex 6y ago
Who says HP didn't use the web page for revoking certificates? Who says HP didn't tell Apple the key was compromised? Why wouldn't Apple assume the private key was compromised if that's the only reason a developer would request revocation?
- _qulr 6y ago
  > Who says HP didn't use the web page for revoking certificates? There's no web page for revoking Developer ID certificates. Only Apple can revoke them. I know because I have a Developer ID certificate myself, and also because Apple says so in section 4.8 of their document: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve... > Who says HP didn't tell Apple the key was compromised? Their key wasn't compromised, so why would they say this? > Why wouldn't Apple assume the private key was compromised if that's the only reason a developer would request revocation? Why would Apple assume anything? Apple can reply to the email, or call HP on the phone. (Apple has the phone # of all registered developers.)
  - pseudalopex 6y ago
    The document doesn't say there isn't a web page. There at least used to be one.[1] The request had to be intentional if they had to email Apple. Whatever reason they thought they had turned out to be incorrect. [1] https://www.quora.com/How-do-I-revoke-my-Apple-Developer-certificate https://www.quora.com/How-do-I-revoke-my-Apple-Developer-cer...
    - _qulr 6y ago
      The document says you have to email Apple Product Security. I also say there isn't a web page, as the owner of a Developer ID cert. That link is for an iOS Development certificate, which is under the WWDR CA, not the Developer ID CA. Compare section 4.8 of this document, which says there is a website for revoking WWDR issued certs: https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.21.pdf https://images.apple.com/certificateauthority/pdf/Apple_WWDR...
      - pseudalopex 6y ago
        The first document says you may email Apple Product Security. The second document does suggest you're correct.

This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.

by _qulr 6y ago

This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.

Talanes 6y ago

How is it stranger than ANY speculation without knowing what HP said in the e-mail?

_qulr 6y ago
Don't you think the lack of transparency from both the Certificate Authority (Apple) and the certificate holder (HP) is troubling? We have one brief vague statement to the press by HP, and nothing at all from Apple. Apple revoked HP's cert, which almost immediately caused all HP software signed with the cert to be disabled on every Mac in the world, and then afterward Apple has absolutely nothing to say about it?
- Talanes 6y ago
  It's definitely troubling, but without more information the truth could be anywhere from "Apple responded thoughtlessly to a request without considering what would happen" to "someone at HP accidentally sent out an e-mail they REALLY shouldn't have."
  - _qulr 6y ago
    The truth could be both of those. ;-)

pseudalopex 6y ago

Who says HP didn't use the web page for revoking certificates? Who says HP didn't tell Apple the key was compromised? Why wouldn't Apple assume the private key was compromised if that's the only reason a developer would request revocation?

_qulr 6y ago
> Who says HP didn't use the web page for revoking certificates? There's no web page for revoking Developer ID certificates. Only Apple can revoke them. I know because I have a Developer ID certificate myself, and also because Apple says so in section 4.8 of their document: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve... > Who says HP didn't tell Apple the key was compromised? Their key wasn't compromised, so why would they say this? > Why wouldn't Apple assume the private key was compromised if that's the only reason a developer would request revocation? Why would Apple assume anything? Apple can reply to the email, or call HP on the phone. (Apple has the phone # of all registered developers.)
- pseudalopex 6y ago
  The document doesn't say there isn't a web page. There at least used to be one.[1] The request had to be intentional if they had to email Apple. Whatever reason they thought they had turned out to be incorrect. [1] https://www.quora.com/How-do-I-revoke-my-Apple-Developer-certificate https://www.quora.com/How-do-I-revoke-my-Apple-Developer-cer...
  - _qulr 6y ago
    The document says you have to email Apple Product Security. I also say there isn't a web page, as the owner of a Developer ID cert. That link is for an iOS Development certificate, which is under the WWDR CA, not the Developer ID CA. Compare section 4.8 of this document, which says there is a website for revoking WWDR issued certs: https://images.apple.com/certificateauthority/pdf/Apple_WWDR_CPS_v1.21.pdf https://images.apple.com/certificateauthority/pdf/Apple_WWDR...
    - pseudalopex 6y ago
      The first document says you may email Apple Product Security. The second document does suggest you're correct.