_qulr

43 ms·

391.
by _qulr 6y ago
Why wouldn't they know? It seems that some people want to claim that Apple has to act based on a single email and is incapable of replying to that email or calling on the phone, when Apple has the phone # of every registered developer.
392.
by _qulr 6y ago
> Software developers have the remote kill switch as well, and they used it this time. How so? They can't unilaterally revoke a Developer ID cert, they can only request that Apple revoke it. > Apple did nothing wrong, unless you’
393.
by _qulr 6y ago
The document says you have to email Apple Product Security. I also say there isn't a web page, as the owner of a Developer ID cert. That link is for an iOS Development certificate, which is under the WWDR CA, not the Developer ID CA. C
394.
by _qulr 6y ago
> Who says HP didn't use the web page for revoking certificates? There's no web page for revoking Developer ID certificates. Only Apple can revoke them. I know because I have a Developer ID certificate myself, and also because
395.
by _qulr 6y ago
Don't you think the lack of transparency from both the Certificate Authority (Apple) and the certificate holder (HP) is troubling? We have one brief vague statement to the press by HP, and nothing at all from Apple. Apple revoked HP&#x
396.
by _qulr 6y ago
Because revoking a Developer ID cert immediately (on the next OCSP check) disables all software ever signed with that cert on every Mac in the world. It's a remote kill switch. I can't emphasize enough what an extreme, last resort
397.
by _qulr 6y ago
I don't think this fully appreciates the consequences of revoking a Developer ID code signing certificate. If a Developer ID cert is revoked, then all software ever signed with that cert is disabled on every Mac in the world, as soon a
398.
by _qulr 6y ago
"hidden img tags to all common gateways (eg 192.168.0.1) are loaded in background onerror/onsuccess events attached to img tags" It has always been a big mistake for browsers to allow internet pages to make requests to LAN IP
399.
by _qulr 6y ago
This is a strange question. HP emailed Apple with the request. HP should state the reason for the request in the email.
400.
by _qulr 6y ago
Nobody is absolving HP. The problem is that there were 2 mistakes in this case. HP mistakenly requested that the cert be revoked, and Apple mistakenly granted the request. If Apple had said no, this problem never would have occurred.
401.
by _qulr 6y ago
> My point, again, was that such a request is NOT "unusual" That depends on what "unusual" means. The only good reason for a developer to request their cert be revoked by Apple is if the private key is compromised, in
402.
by _qulr 6y ago
> un-revoking the certificate would still work fine It's not a question of whether it would "work". If the private key was out in the wild, then Apple would never un-revoke the cert. That would be insane, because anyone co
403.
by _qulr 6y ago
It's not really various circumstances, it's one circumstance: when the private key is compromised. That's why developers email Apple Product Security. It's a security issue. If there's no security issue, then the ce
404.
by _qulr 6y ago
> I stand with Apple’s decision to revoke first and ask questions later. There are only 2 reasons to revoke a code signing certificate: 1) The private key is compromised. 2) The owner of the certificate is signing malware. Obviously HP i
405.
by _qulr 6y ago
We don't need to speculate, the Certification Practice Statement is here: https://images.apple.com/certificateauthority/pdf/Apple_Deve... See section 4.8 in particular. "The Subscriber may initiate a rev
406.
by _qulr 6y ago
> HP revoked its own signing certs rendering their existing signed code invalid. That it took them days to re-sign and published fixed binaries is HP’s fault not Apple’s No, HP requested that Apple revoke the cert. Inexplicably, Apple co
407.
by _qulr 6y ago
> One of the major reasons to revoke a certificate is that the private key is compromised. The private key was not compromised. The proof of this is that Apple un-revoked the very same certificate. The cert is valid again.
408.
by _qulr 6y ago
> HP, the author of the software in question explicitly revoked the certificate HP cannot revoke the cert. Only the CA, Apple, can revoke the cert. HP can only request that Apple revoke the cert, but there was no reason for Apple to gran
409.
by _qulr 6y ago
> Apple’s anti-malware system was actually just working exactly as designed. That's an interesting take, considering that there was no malware involved, and many Mac users were left unable to use their printers.
410.
by _qulr 6y ago
> there were plenty of other equally hot choices, like Yahoo That's one. And if you admit Google was a "hot" choice at the time, that already makes my point. > Google's candidates weren't "highly motivate
411.
by _qulr 6y ago
> What does keep me on Macs is that every now and then I need to compile an iOS app. As a longtime Mac user, I really wish that Apple would make it possible to compile iOS apps on iPad. Not for myself, but for the developers who are only
412.
by _qulr 6y ago
> Google's hiring bar in the early '00s, before they grew into a behemoth, was even higher than it is now My point was that why would any candidate put up with Google's hiring crap if they weren't already extremely mo
413.
by _qulr 6y ago
> Google at a certain point in time managed to hire the talented & motivated people Google started with talented and motivated people. They also hired talented and motivated people, but that in itself is not proof of anything. Did th
414.
by _qulr 6y ago
The author contradicts himself in trying to argue that hiring isn't a crapshoot. On the one hand, he says the best hiring managers "didn’t chase the same pool of candidates everyone else was chasing—instead, they found non-traditi
415.
by _qulr 6y ago
Subscription only link
416.
by _qulr 6y ago
Could this be because Google doesn't have to compete? My impression is that Google Search is worse now than it was in the past. They've gotten complacent. So if they had to fight for users instead of taking them for granted throug
417.
by _qulr 6y ago
Apple support forum search. Developer documentation search. Developer forum search. All absolutely terrible. I use Google with site:apple.com to search all of these instead. If Apple search capabilities are a hidden asset, then they're
418.
by _qulr 6y ago
This is nothing more than a month old tweet from some random person with generic advice and zero empirical evidence to back it up. Why is this even on Hacker News?
419.
by _qulr 6y ago
I'm not sure how this is relevant? Almost every product of every kind comes with a manual or instructions, which buyers are free to read or ignore, possibly with dangerous consequences for the latter. You can stick a metal pot in a mic
420.
by _qulr 6y ago
> You're still not getting the point - which is you're not the customer Apple is trying to sell to Funny how they keep sending me marketing emails though. This is kind of a weird notion, that Apple doesn't want me as a cus

More ›