4 ms·

Unless they can force me to download XCode from someone other than Apple, or somehow hack Apple or force them to support this (not likely), this is a pointless

Unless they can force me to download XCode from someone other than Apple, or somehow hack Apple or force them to support this (not likely), this is a pointless exercise. If you distrust all software that isn't open source and validate it yourself, then I suppose anything is possible. I don't wear foil hats though.

BonsaiDen 12y ago
What would make Apple Servers secure in this case? They most likely have the VeriSign Private Keys at their hands already. Getting an Apple Private Key for signing the binary is also just a few blackmails and a gag order away. The average Apple engineer sure doesn't like to end up in jail for a prolonged time just because they happened to "find" some illegal material on one of his computers. The sad truth is, the frameworks for something like this are already in place. There are "elements" in the government which have total control and surveillance at the very top of their agenda. Controlling the media is easy (see Chinese, Russian State Televion etc.) but you also need to control the Internet these days. China is already really "good" at this and the US is also doing the groundwork, it's not as easy for them as it is for the Chinese, because they don't want to kill their tech sector and the billions of revenue for good overnight, so they have do introduce these things more slowly.
fit2rule 12y ago
They've already demonstrated that they have the means to inject into a binary stream, so unless Apple start encrypting everything - and I mean, everything - that happens between the App store and dragging the App into /Applications, there's little we can do to resolve this issue. This is one of those cases where the betrayal of the NSA/GCHQ/Spy-Agencies-of-the-5-eyes-nations is really obvious. We can no longer trust our developer tools...
- JonCox 12y ago
  Encrypting that entire process doesn't strike me as excessive, I kinda assumed that was already how it's done anyway.
kpcyrd 12y ago
>or force them to support this (not likely) Last time I've checked apple was an US company. https://en.wikipedia.org/wiki/Patriot_Act https://en.wikipedia.org/wiki/Patriot_Act >If you distrust all software that isn't open source Sadly, this isn't enough. A lot of people are pushing for deterministic builds for exactly this reason.

BonsaiDen 12y ago

What would make Apple Servers secure in this case? They most likely have the VeriSign Private Keys at their hands already. Getting an Apple Private Key for signing the binary is also just a few blackmails and a gag order away. The average Apple engineer sure doesn't like to end up in jail for a prolonged time just because they happened to "find" some illegal material on one of his computers. The sad truth is, the frameworks for something like this are already in place. There are "elements" in the government which have total control and surveillance at the very top of their agenda. Controlling the media is easy (see Chinese, Russian State Televion etc.) but you also need to control the Internet these days. China is already really "good" at this and the US is also doing the groundwork, it's not as easy for them as it is for the Chinese, because they don't want to kill their tech sector and the billions of revenue for good overnight, so they have do introduce these things more slowly.

fit2rule 12y ago

They've already demonstrated that they have the means to inject into a binary stream, so unless Apple start encrypting everything - and I mean, everything - that happens between the App store and dragging the App into /Applications, there's little we can do to resolve this issue. This is one of those cases where the betrayal of the NSA/GCHQ/Spy-Agencies-of-the-5-eyes-nations is really obvious. We can no longer trust our developer tools...

JonCox 12y ago
Encrypting that entire process doesn't strike me as excessive, I kinda assumed that was already how it's done anyway.

kpcyrd 12y ago

>or force them to support this (not likely) Last time I've checked apple was an US company. https://en.wikipedia.org/wiki/Patriot_Act https://en.wikipedia.org/wiki/Patriot_Act >If you distrust all software that isn't open source Sadly, this isn't enough. A lot of people are pushing for deterministic builds for exactly this reason.