7 ms·

Notarization has been a nightmare of a solution to a problem that isn't effective. You can get practically as much security by pushing malware signatures to the

Notarization has been a nightmare of a solution to a problem that isn't effective. You can get practically as much security by pushing malware signatures to the client without the massive privacy overreach of having Apple archive each and every bit of code that you generate for distribution. This is just Apple's overreach extended to the desktop. Excessive control that makes developer's lives hell while adding barely any security on top.

eecc 6y ago
Yeah but that puts the burden of verification on Apple. This way the application author has to (legally) undersign their intentions. Makes sense to me...
joseluisq 6y ago
Honestly I never have seen such piece of crap like "Notarization". One of the Apple's failures ever (if is not the most one). A nightmare (and not cheap) to deal with it as a developer.
- Klonoar 6y ago
  $100/yr is fairly cheap all things considered, and it takes thirty minutes Max to set up a bash script to handle it. And that’s just non-Xcode. If you use Xcode it’s often automatic.
  - TomSwirly 6y ago
    > If you use Xcode it’s often automatic. You can't have read the same article I just read!
    - pwinnski 6y ago
      Not everyone has the same difficulties the author did. XCode notarization does work for many developers, perhaps even the majority! It is a fragile process, though, and the author is not the only one for whom it fails.
  - mvanaltvorst 6y ago
    Cheap considering what? Considering the 30% margins they take on any further sale? Considering the 25$ one-time fee the Play Store takes?
    - kalleboo 6y ago
      For macOS (which is what we're talking about in a topic about notarization), you can sell your software any way you want outside of the App Store, without the 30% cut. There's still a $100/year developer account fee to be able to notarize new builds of your app. This is not iOS where the App Store is the only way to install an app. This comment is not an endorsement of any aspect of Apple's business model, I'm just correcting a factual error in your comment.
      - nicky0 6y ago
        Just FWIW it's a 15% cut nowadays. (Unless you are doing >$1million a year of sales, which anyone quibbling over a $100 annual fee isn't.)
        kalleboo 6y ago
        That is correct, but that is a special discount program you have to apply for, wait for judgement, and get approved for in advance. It's not the default. It was a great step forward, but I don't understand why they made it so complicated with an approval process, when Google did the same thing afterwards and could just say "the first million dollars a year is 15%, after that it's 30%". The total revenue difference for the different companies is probably negligible. (or... outside of the App Store you can sign up for a PayPal account and accept payments at a 3% rate instantly)
        nicky0 6y ago
        They review applications because they want to make sure big developers with many apps aren't dividing their apps across lots of different developer accounts so as to get around the total sales cap. (The application form asks questions about other accounts you have, related businesses etc.) If you are a small dev with just one developer account, you'll sail through the applicaton process.
ece 6y ago
Maybe independent notaries are what you're after if privacy is the problem? The web seems to do fine with independent cert providers.
DCKing 6y ago
Having to get any Apple code signing key for regular users is a barrier of entry for malware. However low it is, it is there. Moreover, it gives Apple the power to revoke certificates in the future to at least attempt to contain further malware activity. Is it really that hard to get your code signed as a malware developer? No, not at all. Is that worth bothering developers so much? Maybe not. Is it a power grab? Probably. Does that together make notarization useless for security? No, not really. Notarization is just a step in the chain. It disincentives malware, especially trivial malware (which is the largest quantity and the most relevant for the bulk of the users) by tipping the economics of it slightly less in the malware developer's favor. It does this at the cost of also tipping economics less in regular developer's favor. You may disagree whether or not that's worth it (and I might be inclined to share that opinion), but that doesn't make notarization useless from a security perspective.
- judge2020 6y ago
  The economics also work in Apple's favor as it either requires using your real identity to commit fraud, committing identity theft by creating an LLC with someone else's identity, or paying for a registered agent in a third-world country to sign up for you (not sure how much that costs though, I've never looked!). I'm sure most malware cases they deal with are triaged for the possibility of filing a police report.
  - saagarjha 6y ago
    It turns out that getting access to an Apple developer account is not all that hard.
  - mrtesthah 6y ago
    And how is any of that different from the Developer ID code-signing Apple had already? You still needed to register as either a corp or an individual using legal identifying documents just to generate the certificates. This is the step you seem to be attributing to notarization. It’s not new at all. Moreover, Apple was also already using OSCP to check for revoked certificates when validating the code signature. They’d already revoked malware-producing Developer ID certificates several times in the past before notarization ever existed.
Closi 6y ago
> You can get practically as much security by pushing malware signatures to the client without the massive privacy overreach I think the issue with pushing malware signatures to the client is that it is reactive rather than proactive - i.e. by the time you have identified a malware signature, it is already too late (which leads to an inevitable cat-and-mouse / whack-a-mole game).
- mmis1000 6y ago
  And it does not even work in every case even signature is successfully identified. For example. If the malware already take down the network in some way. There is just no chance for apple to push the malware signatures and fix to client anymore.
- fiddlerwoaroof 6y ago
  So, my take has been that Apple’s been doing a long push to switch incrementally from a Unix user/group/ACL security mode to a capability model: the various entitlements, things like PowerBox not having an API, notarization, etc. The big issue I’ve always had with capability security (as implemented here and in Fuschia) is that, while it is a better security model in many ways, it’s also a lot easier to use against developers and power users, especially when you depend on PKI to implement your unforgeable tokens.
- AnthonyMouse 6y ago
  > I think the issue with pushing malware signatures to the client is that it is reactive rather than proactive - i.e. by the time you have identified a malware signature, it is already too late (which leads to an inevitable cat-and-mouse / whack-a-mole game). But notarization is the same. Apple isn't vetting notarized apps before they're distributed. All it does is impose a cost on the developer, who could still for all you know be a member of the Russian mafia. Or any random developer who has had their machine compromised and then used to sign the compromising party's malware. It doesn't get revoked until somebody identifies the code as malware. It's the same reactive process as malware signatures.
  - zackees 6y ago
jolux 6y ago
>You can get practically as much security by pushing malware signatures to the client without the massive privacy overreach of having Apple archive each and every bit of code that you generate for distribution. Apple do this too, it's called XProtect: https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/1/web/1 https://support.apple.com/guide/security/protecting-against-... They also have a built-in malware remediation tool, which is presumably what was used when they killed the vulnerable Zoom web server on everyone's Mac: https://www.zdnet.com/article/apple-update-kills-off-zoom-web-server/ https://www.zdnet.com/article/apple-update-kills-off-zoom-we... Notarization is clearly part of a defense in depth strategy for macOS.
- hda2 6y ago
  > Notarization is clearly part of a defense in depth strategy for macOS. The issues being called out here is that it comes at too high of a cost to both develops and users compared to the benefits it provides.
  - jolux 6y ago
    I hardly notice the cost as a user. Sometimes I have to right-click and application to open it the first time, same as it’s been since Gatekeeper was introduced as far as I know. As for developers, well. Apple clearly do not treat their developers right.
- barrkel 6y ago
  A defense in depth would be to have layers of trust for applications, identifying and preventing bad behaviours, rather than trying to lock developers in.
  - jolux 6y ago
    >A defense in depth would be to have layers of trust for applications They do, it’s called…code signing and notarization?
- userbinator 6y ago

eecc 6y ago

Yeah but that puts the burden of verification on Apple. This way the application author has to (legally) undersign their intentions. Makes sense to me...

joseluisq 6y ago

Honestly I never have seen such piece of crap like "Notarization". One of the Apple's failures ever (if is not the most one). A nightmare (and not cheap) to deal with it as a developer.

Klonoar 6y ago
$100/yr is fairly cheap all things considered, and it takes thirty minutes Max to set up a bash script to handle it. And that’s just non-Xcode. If you use Xcode it’s often automatic.
- TomSwirly 6y ago
  > If you use Xcode it’s often automatic. You can't have read the same article I just read!
  - pwinnski 6y ago
    Not everyone has the same difficulties the author did. XCode notarization does work for many developers, perhaps even the majority! It is a fragile process, though, and the author is not the only one for whom it fails.
- mvanaltvorst 6y ago
  Cheap considering what? Considering the 30% margins they take on any further sale? Considering the 25$ one-time fee the Play Store takes?
  - kalleboo 6y ago
    For macOS (which is what we're talking about in a topic about notarization), you can sell your software any way you want outside of the App Store, without the 30% cut. There's still a $100/year developer account fee to be able to notarize new builds of your app. This is not iOS where the App Store is the only way to install an app. This comment is not an endorsement of any aspect of Apple's business model, I'm just correcting a factual error in your comment.
    - nicky0 6y ago
      Just FWIW it's a 15% cut nowadays. (Unless you are doing >$1million a year of sales, which anyone quibbling over a $100 annual fee isn't.)
      - kalleboo 6y ago
        That is correct, but that is a special discount program you have to apply for, wait for judgement, and get approved for in advance. It's not the default. It was a great step forward, but I don't understand why they made it so complicated with an approval process, when Google did the same thing afterwards and could just say "the first million dollars a year is 15%, after that it's 30%". The total revenue difference for the different companies is probably negligible. (or... outside of the App Store you can sign up for a PayPal account and accept payments at a 3% rate instantly)
        nicky0 6y ago
        They review applications because they want to make sure big developers with many apps aren't dividing their apps across lots of different developer accounts so as to get around the total sales cap. (The application form asks questions about other accounts you have, related businesses etc.) If you are a small dev with just one developer account, you'll sail through the applicaton process.

ece 6y ago

Maybe independent notaries are what you're after if privacy is the problem? The web seems to do fine with independent cert providers.

DCKing 6y ago

Having to get any Apple code signing key for regular users is a barrier of entry for malware. However low it is, it is there. Moreover, it gives Apple the power to revoke certificates in the future to at least attempt to contain further malware activity. Is it really that hard to get your code signed as a malware developer? No, not at all. Is that worth bothering developers so much? Maybe not. Is it a power grab? Probably. Does that together make notarization useless for security? No, not really. Notarization is just a step in the chain. It disincentives malware, especially trivial malware (which is the largest quantity and the most relevant for the bulk of the users) by tipping the economics of it slightly less in the malware developer's favor. It does this at the cost of also tipping economics less in regular developer's favor. You may disagree whether or not that's worth it (and I might be inclined to share that opinion), but that doesn't make notarization useless from a security perspective.

judge2020 6y ago
The economics also work in Apple's favor as it either requires using your real identity to commit fraud, committing identity theft by creating an LLC with someone else's identity, or paying for a registered agent in a third-world country to sign up for you (not sure how much that costs though, I've never looked!). I'm sure most malware cases they deal with are triaged for the possibility of filing a police report.
- saagarjha 6y ago
  It turns out that getting access to an Apple developer account is not all that hard.
- mrtesthah 6y ago
  And how is any of that different from the Developer ID code-signing Apple had already? You still needed to register as either a corp or an individual using legal identifying documents just to generate the certificates. This is the step you seem to be attributing to notarization. It’s not new at all. Moreover, Apple was also already using OSCP to check for revoked certificates when validating the code signature. They’d already revoked malware-producing Developer ID certificates several times in the past before notarization ever existed.

Closi 6y ago

> You can get practically as much security by pushing malware signatures to the client without the massive privacy overreach I think the issue with pushing malware signatures to the client is that it is reactive rather than proactive - i.e. by the time you have identified a malware signature, it is already too late (which leads to an inevitable cat-and-mouse / whack-a-mole game).

mmis1000 6y ago
And it does not even work in every case even signature is successfully identified. For example. If the malware already take down the network in some way. There is just no chance for apple to push the malware signatures and fix to client anymore.
fiddlerwoaroof 6y ago
So, my take has been that Apple’s been doing a long push to switch incrementally from a Unix user/group/ACL security mode to a capability model: the various entitlements, things like PowerBox not having an API, notarization, etc. The big issue I’ve always had with capability security (as implemented here and in Fuschia) is that, while it is a better security model in many ways, it’s also a lot easier to use against developers and power users, especially when you depend on PKI to implement your unforgeable tokens.
AnthonyMouse 6y ago
> I think the issue with pushing malware signatures to the client is that it is reactive rather than proactive - i.e. by the time you have identified a malware signature, it is already too late (which leads to an inevitable cat-and-mouse / whack-a-mole game). But notarization is the same. Apple isn't vetting notarized apps before they're distributed. All it does is impose a cost on the developer, who could still for all you know be a member of the Russian mafia. Or any random developer who has had their machine compromised and then used to sign the compromising party's malware. It doesn't get revoked until somebody identifies the code as malware. It's the same reactive process as malware signatures.
- zackees 6y ago

jolux 6y ago

>You can get practically as much security by pushing malware signatures to the client without the massive privacy overreach of having Apple archive each and every bit of code that you generate for distribution. Apple do this too, it's called XProtect: https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/1/web/1 https://support.apple.com/guide/security/protecting-against-... They also have a built-in malware remediation tool, which is presumably what was used when they killed the vulnerable Zoom web server on everyone's Mac: https://www.zdnet.com/article/apple-update-kills-off-zoom-web-server/ https://www.zdnet.com/article/apple-update-kills-off-zoom-we... Notarization is clearly part of a defense in depth strategy for macOS.

hda2 6y ago
> Notarization is clearly part of a defense in depth strategy for macOS. The issues being called out here is that it comes at too high of a cost to both develops and users compared to the benefits it provides.
- jolux 6y ago
  I hardly notice the cost as a user. Sometimes I have to right-click and application to open it the first time, same as it’s been since Gatekeeper was introduced as far as I know. As for developers, well. Apple clearly do not treat their developers right.
barrkel 6y ago
A defense in depth would be to have layers of trust for applications, identifying and preventing bad behaviours, rather than trying to lock developers in.
- jolux 6y ago
  >A defense in depth would be to have layers of trust for applications They do, it’s called…code signing and notarization?
userbinator 6y ago