4 ms·

Expired certificate breaks macOS Logitech apps

36 points by worik 10mo ago

Neywiny 10mo ago
The downside of ridiculously overcomplicating the task. Certificates for IPC? So if somebody runs a virus on the computer they can't tell that one program told the other that you want your RGB to be brighter?
- simulator5g 10mo ago
  The point of certificates is that they prevent things like MITM attacks on updates that replace the legitimate app with a malicious version. They also prevent you from installing fake software if you know how to use them, e.g from a malicious ad that looked just like the real Logitech site. They're also requited for all mac app store apps, it's not really about the specific use case of the app.
  - Neywiny 10mo ago
    I'm not understanding the relevance to IPC. What do updates and the app store have to do with inter process communication?
- danpalmer 10mo ago
  Or they can't write a piece of software that sees your keypresses in the background?
  - Neywiny 10mo ago
    Key loggers do not need to attack Logitech software to work, so I don't see the relevance
    - danpalmer 10mo ago
      Maybe? Maybe not? My point was that there are perfectly legitimate reasons to have tight security on software that deals with input devices. In the age of sandboxed software I wouldn't be surprised if you can't just get all key presses as non-interactive background software, or if you could get them by reading them from Logi Options.
basilikum 10mo ago
They say on Reddit: https://old.reddit.com/r/logitech/comments/1q66q1l/just_realized_i_am_just_the_a_clown/nyeck29/?context=3 https://old.reddit.com/r/logitech/comments/1q66q1l/just_real... > There is no need for an online connection. There is some misunderstanding of what the certificate is. It has no online connection dependency. It is a developer certification that is extremely common on macOS apps. The cert only caused an issue because we let it expire. We now have strict processes in place to maintain the certification The article also says that the expired certificate breaks auto updates. What kind of certificate is this exactly?
- cweagans 10mo ago
  It's probably the dev cert for macOS.
- heartbreak 10mo ago
  The code signing certificate for macOS apps.
- spondyl 10mo ago
  This will be a standard Apple Developer code-signing certificate used in the signing and notarision process: https://support.apple.com/en-nz/guide/security/sec3ad8e6e53/web https://support.apple.com/en-nz/guide/security/sec3ad8e6e53/... Without a signature, Gatekeeper will throw up a dialog saying "This app could contain malware" or something to that effect. If you're using other libraries, such as the Sparkle Framework (a popular macOS Objective-C(?) library for updater logic), I believe you have to sign those as well. That said, the autoupdater may have technically been a second .app bundled within the main one and trying to launch it resulted in a failure to recognise the certificate. As far as I understand, certain compilers such as Go are signed themselves and technically fiddle with created binaries in an above-board way that they pass Apple's requirements, otherwise you would have to explicitly allow them to run every time. Having signed some open-source apps myself though, I didn't realise that certificates could retroactively expire. I haven't tried but I assumed that you would just be unable to sign new versions.
  - fingerlocks 10mo ago
frizlab 10mo ago
Related: https://news.ycombinator.com/edit?id=46548904 https://news.ycombinator.com/edit?id=46548904
hoss1474489 10mo ago
Always hated Logitech Options bloatware, why should the software drain my battery, phone home, and require screen recording permission just to emulate a keystroke when I push a button on the mouse? I enjoyed my trip to Micro Center today to finally ditch Logitech after those buttons stopped working. Put up with Options for over a decade because at least it did the one thing I needed.
- cweagans 10mo ago
  I love the hardware. Software sucks. When this broke today, I just downloaded SteerMouse and updated my license. Never going back to the Logitech software.
  - hoss1474489 10mo ago
    In my frustration I didn’t even think to look if there was a third party solution. Looks like that would do the one thing I need, and I’m finding the grass to be just as brown with Razer Synapse is it is with LogiOptions.
- freefaler 10mo ago
  Just install something like "Better touch tool" you'll get the functionality (and more) without the bloat.
  - coumbaya 10mo ago
    To be fair, it lack some functionality, like mapping a single modifier to a button

36 points by worik 10mo ago

The downside of ridiculously overcomplicating the task. Certificates for IPC? So if somebody runs a virus on the computer they can't tell that one program told the other that you want your RGB to be brighter?

simulator5g 10mo ago
The point of certificates is that they prevent things like MITM attacks on updates that replace the legitimate app with a malicious version. They also prevent you from installing fake software if you know how to use them, e.g from a malicious ad that looked just like the real Logitech site. They're also requited for all mac app store apps, it's not really about the specific use case of the app.
- Neywiny 10mo ago
  I'm not understanding the relevance to IPC. What do updates and the app store have to do with inter process communication?
danpalmer 10mo ago
Or they can't write a piece of software that sees your keypresses in the background?
- Neywiny 10mo ago
  Key loggers do not need to attack Logitech software to work, so I don't see the relevance
  - danpalmer 10mo ago
    Maybe? Maybe not? My point was that there are perfectly legitimate reasons to have tight security on software that deals with input devices. In the age of sandboxed software I wouldn't be surprised if you can't just get all key presses as non-interactive background software, or if you could get them by reading them from Logi Options.

basilikum 10mo ago

They say on Reddit: https://old.reddit.com/r/logitech/comments/1q66q1l/just_realized_i_am_just_the_a_clown/nyeck29/?context=3 https://old.reddit.com/r/logitech/comments/1q66q1l/just_real... > There is no need for an online connection. There is some misunderstanding of what the certificate is. It has no online connection dependency. It is a developer certification that is extremely common on macOS apps. The cert only caused an issue because we let it expire. We now have strict processes in place to maintain the certification The article also says that the expired certificate breaks auto updates. What kind of certificate is this exactly?

cweagans 10mo ago
It's probably the dev cert for macOS.
heartbreak 10mo ago
The code signing certificate for macOS apps.
spondyl 10mo ago
This will be a standard Apple Developer code-signing certificate used in the signing and notarision process: https://support.apple.com/en-nz/guide/security/sec3ad8e6e53/web https://support.apple.com/en-nz/guide/security/sec3ad8e6e53/... Without a signature, Gatekeeper will throw up a dialog saying "This app could contain malware" or something to that effect. If you're using other libraries, such as the Sparkle Framework (a popular macOS Objective-C(?) library for updater logic), I believe you have to sign those as well. That said, the autoupdater may have technically been a second .app bundled within the main one and trying to launch it resulted in a failure to recognise the certificate. As far as I understand, certain compilers such as Go are signed themselves and technically fiddle with created binaries in an above-board way that they pass Apple's requirements, otherwise you would have to explicitly allow them to run every time. Having signed some open-source apps myself though, I didn't realise that certificates could retroactively expire. I haven't tried but I assumed that you would just be unable to sign new versions.
- fingerlocks 10mo ago

frizlab 10mo ago

Related: https://news.ycombinator.com/edit?id=46548904 https://news.ycombinator.com/edit?id=46548904

hoss1474489 10mo ago

Always hated Logitech Options bloatware, why should the software drain my battery, phone home, and require screen recording permission just to emulate a keystroke when I push a button on the mouse? I enjoyed my trip to Micro Center today to finally ditch Logitech after those buttons stopped working. Put up with Options for over a decade because at least it did the one thing I needed.

cweagans 10mo ago
I love the hardware. Software sucks. When this broke today, I just downloaded SteerMouse and updated my license. Never going back to the Logitech software.
- hoss1474489 10mo ago
  In my frustration I didn’t even think to look if there was a third party solution. Looks like that would do the one thing I need, and I’m finding the grass to be just as brown with Razer Synapse is it is with LogiOptions.
freefaler 10mo ago
Just install something like "Better touch tool" you'll get the functionality (and more) without the bloat.
- coumbaya 10mo ago
  To be fair, it lack some functionality, like mapping a single modifier to a button