5 ms·

What with Gatekeeper* and Developer ID, who didn't see this coming? How else do you protect the walled garden from vile betrayers that come in via Developer ID?

by delinka 14y ago

What with Gatekeeper* and Developer ID, who didn't see this coming? How else do you protect the walled garden from vile betrayers that come in via Developer ID? Criminal Hacker gets Dev ID, makes malicious app, distributes said app, runs for months, then one day whamo! it does Nasty Shit. Apple blacklists the app and the Dev ID certs. Easier worm and virus control. At least until one of these rogue devs finds a privilege escalation bug that gets it out of the sandbox and also into more privileged execution. It's not a magic bullet, but it'll be a good thing unless they abuse it. An example of Apple's track record in this regard would be GPL apps on the App Store - they'll pull the app from the store but I have yet to hear Apple 'remote wiping' someone's previously downloaded apps. Tangentially, I'm a little miffed at spending $100 to get certificates to do Developer ID, but in the Grand Scheme of Business, it's just not that much money. *I have flashbacks to 'The Net' - I shudder

__david__ 14y ago
It's worth noting that 75% to 80% of the (pretty short) blacklist is Apple's own stuff.
- wtallis 14y ago
  And those are probably some of the most annoying bits, since many of us prefer the old iCal, Address Book, and Front Row.
  - pooriaazimi 14y ago
    I bet $50 the old iCal, Address Book and Front Row are not compatible with new security restrictions introduced in ML, so again you should be happy Apple has blacklisted them. That doesn't mean that I like the current state of these apps any more than you.
ceejayoz 14y ago
> Tangentially, I'm a little miffed at spending $100 to get certificates to do Developer ID, but in the Grand Scheme of Business, it's just not that much money. My understanding is that Gatekeeper signing is free.
- taylorfausak 14y ago
  It's free for Mac Developer Program members [1]. In other words, it's free once you spend $100 per year. [1]: https://developer.apple.com/resources/developer-id/ https://developer.apple.com/resources/developer-id/
  - runn1ng 14y ago
    This is basically Apple's definition of "free".
- delinka 14y ago
  Depends on how you define "free." Apple says "no additional charge over your Mac Dev membership. It's included with the Mac Developer Program." I spent two entire days watching WWDC videos and digging around on developer.apple.com trying to find out how to get certificates without paying Apple the $99 for Mac Dev. The Apple employees that I am connected to were also surprised to find out that it wasn't free outside the Mac Dev program. A former Appler helping me dig around also noted that Apple never said it'd be "free." If you can find somewhere Apple said it would be free, I'd love to dig deeper.
  - deleted 14y ago
    [deleted]
  - phillmv 14y ago
    >I spent two entire days watching WWDC videos and digging around on developer.apple.com trying to find out how to get certificates without paying Apple the $99 for Mac Dev. You've lost more than that already. Just pony up.
  - jvdongen 14y ago
    Don't know about you, but with my hourly rate wasting 2 whole days on looking for a way to avoid a 99 dollar fee does not make sense ...
    - CrazedGeek 14y ago
deleted 14y ago
[deleted]
batista 14y ago
>It's not a magic bullet, but it'll be a good thing unless they abuse it. An example of Apple's track record in this regard would be GPL apps on the App Store - they'll pull the app from the store but I have yet to hear Apple 'remote wiping' someone's previously downloaded apps. Actually they won't "pull the app" by themselves. At least in the one example I'm aware off, a minor contributor to a project (VLC) specifically _asked_ Apple to remove the app from the iOS app store, pissing on both the users wanting it AND the developers doing the porting for free and making the source code available for everyone, because it being on the app store didn't satisfy some GPL technicality.
- deleted 14y ago
  [deleted]
- r00fus 14y ago
  The move by the VLC developer (Rémi Denis-Courmont) [1] makes more sense when you realize was working for Nokia at the time [2]. [1] http://www.ilounge.com/index.php/news/comments/vlc-developer-claims-app-store-infringing-vlc-license/ http://www.ilounge.com/index.php/news/comments/vlc-developer... [2] http://www.linkedin.com/in/remidenis http://www.linkedin.com/in/remidenis
  - 0x0 14y ago
    Holy shit, I never realized! That's a bit of a scandal!
- lmm 14y ago
  It's not a technicality. It was violating the GPL. I wouldn't want a GPL project I'd contributed to released that way either.
  - batista 14y ago
    Yes, but other people working on the GPL project, including more major contributors didn't have a problem with the porting and availability on iOS. I guess all it takes is a misguided picking of licence in the beginning and a zealot that contributed somewhat (even marginally) to ruin it for all the other contributors who could care less about 100% enforcement. Maybe that explains why BSD and MIT style licences rule the roost when it comes to new projects on GitHub...