30 ms·
I've been through hell and back on both Windows and MacOS with application signing. It's only getting worse. First thing I have to note is that this really mak
by xrd 3y ago
I've been through hell and back on both Windows and MacOS with application signing. It's only getting worse.
First thing I have to note is that this really makes me want to offer anything as a web app. The browser offers a much better experience in so many ways and security is a well thought out integrated experience unlike these 25 year old operating systems bolting security on as an after thought. Clearly no one at Apple cares about this but that would be funny if this was the crack in the dam that broke down their hardware software monopoly.
Second thing is why can't a third party offer this as a service? I'm not limited in the number of apps I can sign technically, right? Why would people using my app care that the certificate says it is signed by me instead of (trusted by the os) ABC, corp that (Microsoft|Apple) says in their overlaid dialog they trust. They could revoke something in the chain but it's technically possible right? Is this explicitly prohibited in some EULA I accepted in a brain fog?
- safeimp 3y agoWouldn’t this be a liability though? In this scenario are you just blindly signing whatever? If yes, that’s obviously not good. The alternative is you have a long review and audit process but in the event something falls through the cracks, this still bites you.
- xrd 3y agoI would be happy to pay for the service. It wouldn't be just the cost of the certificate. It would be the months of labor spent fighting the operating systems and their intricacies. This feels like knowledge that could be managed at scale much better than me doing it in isolation. The cost to me is much greater than just the cost of the certificate, though it's an issue for open source work. And I would be so happy to subsidize that work through a reputable service that was consistent and did that fighting for me.
- Dalewyn 3y agoSeeing as we're now HTTPSing everything under the sun including the malicious, I don't see the problem signing every single binary under the sun regardless malevolence.
- xrd 3y agoAs others have noted on this topic, HTTPS only requires knowing the domain which can be addressed using DNS records. With app signing the operating system vendors want to know you are a legitimate business which means Duns and Bradstreet number and often more, which is much more complicated to validate.
- jacquesm 3y agoI've gone through exactly that decision tree for Pianojacq and even though it made a lot of stuff much harder (notably: database work) I'm really happy with the result and apparently so are the users. Funny thing: I recently had someone tip me off to start using it :) They were quite surprised I was the main author.
- ashleyn 3y agoWASM and WebGPU are closing the performance gaps between browser and native. It's getting to the point where if it's not a device driver, it can probably be recompiled for use client-side in the browser.
- pjmlp 3y agoYet another bytecode runtime, as many others since the 1960's, and a GPU technology based on 2015's hardware capabilities, only supported currently by ChromeOS (nee Web).