4 ms·

Windows has required code signing for kernel drivers since Vista on x64. Also, OSX doesn't require the kexts to be signed by Apple themselves - the requirement

by 0x0 12y ago

Windows has required code signing for kernel drivers since Vista on x64. Also, OSX doesn't require the kexts to be signed by Apple themselves - the requirement is that the kext is signed by a certificate that is blessed by Apple's CA. There are plenty of third party kexts out there. Also, you can modify the bootloader's kernel parameters to disable kext signing and you will be back where you were on 10.9 security-wise. A much bigger problem is how Microsoft is no longer requiring Windows 10 compatible PCs to ship with a way to disable Secure Boot.

Demiurge 12y ago
>Also, OSX doesn't require the kexts to be signed by Apple themselves - the requirement is that the kext is signed by a certificate that is blessed by Apple's CA. There are plenty of third party kexts out there. I'm curious who has Apple blessed to do so, and what those kexts are?
- ptomato 12y ago
  Anybody who pays the $99/year to be an OS X developer and hasn't subsequently had their cert revoked for distributing malware.
  - Demiurge 12y ago
    Well, that's quite accessible. Good to know, thanks.
    - easytiger 12y ago
      What a depressing attitude
      - Demiurge 12y ago
        Maybe go see a doctor about that. Just because I'm asking a question and then not committing righteous suicide because of how great my first world problems are, doesn't mean I actually expressed an opinion about driver signing in general, one way or another.
JohnTHaller 12y ago
Windows code signing is performed using a certificate available from the usual certificate authorities (Verisign, Thawte, etc, etc) that you pay to verify your identity and issue you a signing certificate. Apple is the only one that enables OSX signing and it's done in conjunction with your Apple ID that you pay Apple a yearly fee to enable developer abilities on.
- beefsack 12y ago
  The fact that this became a back and forth of people arguing which is worst just highlights the fact that this sort of low level infrastructure needs to be free and open.
  - azinman2 12y ago
    Does it? But then who polices it? Id be curious to know of an instance where apple abuses their power and denied a competitor the ability to sign a binary. Personally I'd much rather have someone like apple be able to have some kind of audit where by malicious extensions can be revoked. There might be some super clever way that you could do this with the block chain or the like, but ultimately I don't know how this doesn't come down to a person somewhere deciding.
    - UweSchmidt 12y ago
      "Id be curious to know of an instance where apple abuses their power and denied a competitor the ability to sign a binary." This will happen the instant it becomes opportune, Apple being a business, having shareholders and all that. No precedent is needed (they surely have used their power to deny stuff that is not "malicious" in the App Store before).
      - Angostura 12y ago
        > This will happen the instant it becomes opportune You'll see. Personally, I'm happy to be at least notified when something random attempts to install an unsigned kernel extension.

by 0x0 12y ago

Demiurge 12y ago

>Also, OSX doesn't require the kexts to be signed by Apple themselves - the requirement is that the kext is signed by a certificate that is blessed by Apple's CA. There are plenty of third party kexts out there. I'm curious who has Apple blessed to do so, and what those kexts are?

ptomato 12y ago
Anybody who pays the $99/year to be an OS X developer and hasn't subsequently had their cert revoked for distributing malware.
- Demiurge 12y ago
  Well, that's quite accessible. Good to know, thanks.
  - easytiger 12y ago
    What a depressing attitude
    - Demiurge 12y ago
      Maybe go see a doctor about that. Just because I'm asking a question and then not committing righteous suicide because of how great my first world problems are, doesn't mean I actually expressed an opinion about driver signing in general, one way or another.

JohnTHaller 12y ago

Windows code signing is performed using a certificate available from the usual certificate authorities (Verisign, Thawte, etc, etc) that you pay to verify your identity and issue you a signing certificate. Apple is the only one that enables OSX signing and it's done in conjunction with your Apple ID that you pay Apple a yearly fee to enable developer abilities on.

beefsack 12y ago
The fact that this became a back and forth of people arguing which is worst just highlights the fact that this sort of low level infrastructure needs to be free and open.
- azinman2 12y ago
  Does it? But then who polices it? Id be curious to know of an instance where apple abuses their power and denied a competitor the ability to sign a binary. Personally I'd much rather have someone like apple be able to have some kind of audit where by malicious extensions can be revoked. There might be some super clever way that you could do this with the block chain or the like, but ultimately I don't know how this doesn't come down to a person somewhere deciding.
  - UweSchmidt 12y ago
    "Id be curious to know of an instance where apple abuses their power and denied a competitor the ability to sign a binary." This will happen the instant it becomes opportune, Apple being a business, having shareholders and all that. No precedent is needed (they surely have used their power to deny stuff that is not "malicious" in the App Store before).
    - Angostura 12y ago
      > This will happen the instant it becomes opportune You'll see. Personally, I'm happy to be at least notified when something random attempts to install an unsigned kernel extension.