4 ms·
Apple doesn't check binary hashes but developer certificates these binaries are signed with. Which there are a lot less of (ie. firefox and thunderbird share th
by aequitas 6y ago
Apple doesn't check binary hashes but developer certificates these binaries are signed with. Which there are a lot less of (ie. firefox and thunderbird share the same certificate).
- tgv 6y agoFrom what I understood, Gatekeeper still sends an application specific hash/ticket when an application is opened, not just a dev certificate (e.g. https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm...). Did that change in Big Sur?
- _qulr 6y agoThe notarization check is on first launch of an app, but it doesn't occur on subsequent launches, unlike the certificate revocation check.
- tgv 6y agoBut the first lookup would have to stay, with all the implications that the proposed alternative (download a list of all certs/tickets) was meant to overcome.