3 ms·

>It also significantly reduces the usefulness of code signing for the vast majority I'd argue that code signing for the average person has zero utility on Wind

>It also significantly reduces the usefulness of code signing for the vast majority I'd argue that code signing for the average person has zero utility on Windows, and negative utility on macOS. I really don't think anybody understands or even cares what a certificate means, and the only practical outcome is that sometimes they get scary messages when the app they're installing didn't pay MS for a license.

microtonal 3y ago
macOS by default doesn't run unsigned or incorrectly signed apps, period. Only Apple can hand out certificates and certificates are at the very least associated with payment info (though sometimes they want more, DUNS number or whatever). Signed application bundles remove many attack vectors. The primary remaining vectors are: 1. A malicious entity can sign up for a developer account. 2. A non-malicious entity's certificate can be compromised. (1) does not seem to happen often, if it does happen, Apple can revoke the certificate. They can also increase the burden of proof for creating a developer account if it becomes more common. (2) happens occasionally. Apple can revoke the key. But in general there is a strong incentive for developers to properly protect their signing keys, because Apple could ban them by not signing their keys in the case of repeated issues. Code signing substantially increases platform security and as a 16 year macOS user, I would not want to go back to pre-signing days, where you could never be sure whether an application bundle was compromised, unless you'd verify the archive/disk image with GnuPG. But that is opening a big can of worms (WoT, etc.).
- __david__ 3y ago
  > macOS by default doesn't run unsigned or incorrectly signed apps, period. It kinda depends on what you mean by “default”, but you can always right click an app in Finder and select “open”. When you get the scary “unsigned app” pop-up there will be an extra option there to run it anyway, allowing you to run unsigned binaries without making any settings changes to the os. That said, I largely agree with the rest of your comment. I do think, as a developer, their stapling stuff is way more onerous than the plain code signing. It basically puts Apple in the position to reject your app in the same way they reject apps in the store, even though there is no store involved.
  - brnt 3y ago
    You only can if you are the admin on your system or enter admin credentials. I don't know, is that still the default?
    - __david__ 3y ago
      Maybe? It has never asked for credentials when I do that, but I’ve also never not been an admin on my computer (which is default), so I don’t know.

microtonal 3y ago

macOS by default doesn't run unsigned or incorrectly signed apps, period. Only Apple can hand out certificates and certificates are at the very least associated with payment info (though sometimes they want more, DUNS number or whatever). Signed application bundles remove many attack vectors. The primary remaining vectors are: 1. A malicious entity can sign up for a developer account. 2. A non-malicious entity's certificate can be compromised. (1) does not seem to happen often, if it does happen, Apple can revoke the certificate. They can also increase the burden of proof for creating a developer account if it becomes more common. (2) happens occasionally. Apple can revoke the key. But in general there is a strong incentive for developers to properly protect their signing keys, because Apple could ban them by not signing their keys in the case of repeated issues. Code signing substantially increases platform security and as a 16 year macOS user, I would not want to go back to pre-signing days, where you could never be sure whether an application bundle was compromised, unless you'd verify the archive/disk image with GnuPG. But that is opening a big can of worms (WoT, etc.).

__david__ 3y ago
> macOS by default doesn't run unsigned or incorrectly signed apps, period. It kinda depends on what you mean by “default”, but you can always right click an app in Finder and select “open”. When you get the scary “unsigned app” pop-up there will be an extra option there to run it anyway, allowing you to run unsigned binaries without making any settings changes to the os. That said, I largely agree with the rest of your comment. I do think, as a developer, their stapling stuff is way more onerous than the plain code signing. It basically puts Apple in the position to reject your app in the same way they reject apps in the store, even though there is no store involved.
- brnt 3y ago
  You only can if you are the admin on your system or enter admin credentials. I don't know, is that still the default?
  - __david__ 3y ago
    Maybe? It has never asked for credentials when I do that, but I’ve also never not been an admin on my computer (which is default), so I don’t know.