Live data from Hacker News

Apple revoked longtime Mac developer's code signing certificate with no warning

twitter.com

71–80 of 180 posts

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#71
post #24

Earlier quoted context omitted.

Okay, so what are the situations where it can be false? * apple actually did communicate to them, but it was via carrier pigeon or something and it got lost * apple is under gag order * the developer is actually a long time repeat offender and is trying to evade via sockpuppet accounts None of them seem plausible to me. Also, unlike with the apple 30% refund fiasco, we know for sure this is happening, because other u…

How does other users receiving errors prove that the developer received no warning? Your first bullet point seems entirely plausible, albeit the failure mode is likely less avian.

Hi, I'm the developer.

* No email in my spam box. * My contact address is still working and have received notifications about them approving my updates for the App Store yesterday (so saying that they have no way of contacting me is not true). * No known breach of account. * No accidental revocation (I was sleeping while this happened). * The certificates are revoked as you can verify via command line.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#72
post #53

Earlier quoted context omitted.

They pretty clearly have a monopoly on iOS app stores. Now we can skip the part where somebody says that you can't have a monopoly on your own product and then I point out that monopolies always look like that because their product is the only one in the market, and the reason that android app stores and iOS app stores are different markets is that you can't install Android apps on iOS devices or vice versa.

Surely by moving the goalposts you can make everything look like a monopoly. In the end both mobile platforms have practically the same popular apps.

I feel like it's worth pointing out that in the industry that spurred the development of anti-monopoly legislation, there were ~20 major companies. Or ~150, if you go by the definition of "large" established ~30 years later. (By either definition, there's 7 today in the same industry, if you're wondering).

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#73
post #33

Earlier quoted context omitted.

Apple is not a monopoly. Additionally this is a Mac app and you can sideload apps on Macs

They pretty clearly have a monopoly on iOS app stores. Now we can skip the part where somebody says that you can't have a monopoly on your own product and then I point out that monopolies always look like that because their product is the only one in the market, and the reason that android app stores and iOS app stores are different markets is that you can't install Android apps on iOS devices or vice versa.

    > Now we can skip the part where somebody says that you
    > can't have a monopoly on your own product
No, we actually cannot skipt that part. Or maybe we can skip the part where you are human and not a camel and then discuss how many days can you spend in a desert without water?

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#74
post #49

Original tweet: > "Hello everyone, today I woke up to my developer account being suspended without a single letter why which is why the apps are crashing. Please bear with me while I try to get this fixed with Apple. Thank you for understanding." Not being a Mac developer, the wording about revoking the certificate makes it sound a little more unusual than just their account being banned. Although not nice, I assume…

The developer's account is liked to the certificates used to sign their app binaries. If MacOS is set to only allow signed binaries to run, that means this developer's app binaries won't run.

Their customers can work around this by disabling the requirement for signed binaries, but of course that's not desirable and in corporate environments might not be allowed.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#75
post #58
post #37

Earlier quoted context omitted.

- Developer was hacked and is unaware of it. - Developer accidentally clicked "revoke my cert" (no idea if that's a real button, but that's not the point). - A national security agency sent one of those scary letters preventing Apple from speaking but requiring the action. - Developer had a mental breakdown and has lost grip on reality. - Developer realized app was infected with malware and ... Truth is stranger than…

> - Developer was hacked and is unaware of it. If that's the case why wasn't that communicated to him? >- Developer accidentally clicked "revoke my cert" (no idea if that's a real button, but that's not the point). >- Developer had a mental breakdown and has lost grip on reality. While these are possible, they seem very unlikely. Compare the numerous cases of Big Tech silently revoking people's account with no notice…

Big Tech is not a monolithic entity and citing cases across different entities may not be an appropriate way to compare these issues. Asking for patience while both sides have a chance to explain the situation is reasonable.

Also, whenever you suggest something is "very unlikely," keep in mind that this likelihood is one instance in the context of 20 million developers. Are you suggesting it's like a 1 out of 100 chance, or a 1 out of 20 million chance?

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#76

Earlier quoted context omitted.

I think certificate revocation of signed code is a good, useful feature and something that I want as part of my security infrastructure. I wouldn't want it any other way if I have to use non-open source code that I can't inspect. But the basis of all my core software is going to be open source.

This will lead to computing being locked down further with really questionable benefits. In fact open source software can suffer greatly because these certs make deployment cost non-zero. So someone providing binaries of such software has to pay for it to large corps like Apple and Microsoft.

We've been in this situation for 10 years now. Has the slippery slope caused any sliding yet?

The cost issue is separate from the revocation issue, and my point was about certain revocation--it's an absolutely great feature for any code signing situation where you are trusting others to compile code for you and others can't confirm that a certain set of binaries came from a certain set of source files. (Reproducible builds could help, of course!)

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#77
post #73

Earlier quoted context omitted.

They pretty clearly have a monopoly on iOS app stores. Now we can skip the part where somebody says that you can't have a monopoly on your own product and then I point out that monopolies always look like that because their product is the only one in the market, and the reason that android app stores and iOS app stores are different markets is that you can't install Android apps on iOS devices or vice versa.

> Now we can skip the part where somebody says that you > can't have a monopoly on your own product No, we actually cannot skipt that part. Or maybe we can skip the part where you are human and not a camel and then discuss how many days can you spend in a desert without water?

We can skip (could have skipped?) that part because I already posted the rebuttal:

> monopolies always look like that because their product is the only one in the market, and the reason that android app stores and iOS app stores are different markets is that you can't install Android apps on iOS devices or vice versa.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#78
post #69

The developer's website (software.charliemonroe.net) is also blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. I wonder if these things are related?

It has an app for downloading videos off YouTube and other video sites. Not sure how much influence media companies have in the UK but maybe that's why? I know YouTube downloading services have struggled in the past to stay operational.

I don't think so. There are many "YouTube downloader" type apps, and none of the others are blocked as far as I can tell.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#79
post #62

Sadly, this is what a walled garden results in. Please don't be surprised, shocked or even remotely discontent because by signing the ToS you have waived away any and all of your rights regarding the use and publishing of software in this walled garden. The only reason an issue like this will get "fixed" is when this (post/tweet) goes viral and the PR department will work extra hard to correct this.

WTF. I dare any one of you who downvoted this to explain why in public.

Because it is a lot of hand-waving bullshit. This "walled garden" talk gets tiring fast. And, uh oh, big surprise, you have to actually behave according to ToS you signed. How can it be, hmmm? Nobody forces you to sign anything. Go have your own platform and distribution chanells. Oh, you want to be where the money is? Well, than. Maaaaybe there is some correlation between being the walled garden and the place there the money is?

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#80
post #47
post #7

I suspect it has something to do with Apple wading into content publishing and the alliances it would strengthen to suppress even suspected piracy.

[deleted]

Is it a front end for youtube-dl?
Post reply on HN