Apple revoked longtime Mac developer's code signing certificate with no warning • Hacker News Board

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#81

Post by robterrell » Tue, Aug 04, 2020, 2:48 PM UTC

jtbayly wrote: post #4

lqet wrote: post #3

I suspect this is why: > Ever wished you could save a video from the Internet? Search no more, Downie is what you're looking for. Easily download videos from thousands of different sites.

Is there something wrong with downloading videos to my computer?

Apple might think so! I had a popular YouTube downloader app for Mac OS and I spent a lot of time on a port for iOS, but it was rejected from the app store back in 2010. The app reviewer did call me on the phone to tell me -- in fact, she called twice, once to tell me that my app was going into an extended review, and then a few weeks later she called to tell me that my app had been rejected. When I asked what the reason was, she told me to check the review guidelines ("check them again now" she said) and lo and behold, they had added a new guideline about downloading media without explicit IP rights. Moving the goalposts, one app at a time!

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#82

Post by ballenf » Tue, Aug 04, 2020, 2:50 PM UTC

digi59404 wrote: post #32

vaxman wrote: post #20

Apple also has the ability to remotely login to EVERYONE's Internet-connected Mac computers and monkey around (removing software etc.). Of course, they only use this when THEY feel it's really necessary. Does not matter if you subscribe to any of their paid services, does not matter if you bought a used MacMini for 50 dollars or paid 50,000 dollars for a MacPro7. Some would say "great, wish we could do it to real vir…

Pretty sure Apple doesn’t have this capability. What you’re referring too is functionality inside GateKeeper or near GateKeeper. Which is where Apple marks an application with a specific signature to be malware or dangerous and the OS automatically removes it. This is similar to an antivirus software removing it. There’s no login functionality, Apple doesn’t see your data and doesn’t do anything on your machine other…

Apple's first wish from the genie in a bottle was for unlimited wishes. So it doesn't really make sense to argue over whether Apple only has x-ray vision or also the ability to walk through walls yet.

Gatekeeper is our benevolent dictator that consolidates power with every update because our connectedness increases the potential for widespread damage from our attackers.

And I'm ok with that, but worry we'll regret things later.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#83

Post by cdubzzz » Tue, Aug 04, 2020, 2:53 PM UTC

_qulr wrote: post #67

CubsFan1060 wrote: post #14

Perhaps we should wait to get the whole story to discuss. Didn't we just go through this with the "Apple doesn't return 30% on refund" fiasco last week?

Except that it's been verified by many people, and you can verify on your own Mac, that the developer's certificate has indeed been revoked, and the apps don't work. That part of the story is indisputable.

Sure but the important part of the tweet is “with no warning”. That’s why it is being posted here.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#84

Post by selectodude » Tue, Aug 04, 2020, 2:55 PM UTC

vbezhenar wrote: post #31

CodeWriter23 wrote: post #6

Earlier quoted context omitted.

> Is there something wrong with downloading videos to my computer? Nope. Creating a tool perceived by those with enough lawyers to be a “copy protection circumvention device” however does run afoul of the DMCA.

Why does Apple care? It's none of their business.

Because Apple is the one that will be party to a lawsuit if it ever came to pass. One of the negatives of being gatekeeper is you're no longer protected by "safe harbor" provisions. And I have to imagine Apple has enough money to be worth suing, even if it's frivolous nonsense.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#85

Post by sjs382 » Tue, Aug 04, 2020, 2:55 PM UTC

charlieMonroe wrote: post #71

hunter2_ wrote: post #27

Earlier quoted context omitted.

How does other users receiving errors prove that the developer received no warning? Your first bullet point seems entirely plausible, albeit the failure mode is likely less avian.

Hi, I'm the developer. * No email in my spam box. * My contact address is still working and have received notifications about them approving my updates for the App Store yesterday (so saying that they have no way of contacting me is not true). * No known breach of account. * No accidental revocation (I was sleeping while this happened). * The certificates are revoked as you can verify via command line.

Please keep us updated with what comes of this!

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#86

Post by auganov » Tue, Aug 04, 2020, 2:56 PM UTC

simonh wrote: post #74

auganov wrote: post #49

Original tweet: > "Hello everyone, today I woke up to my developer account being suspended without a single letter why which is why the apps are crashing. Please bear with me while I try to get this fixed with Apple. Thank you for understanding." Not being a Mac developer, the wording about revoking the certificate makes it sound a little more unusual than just their account being banned. Although not nice, I assume…

The developer's account is liked to the certificates used to sign their app binaries. If MacOS is set to only allow signed binaries to run, that means this developer's app binaries won't run. Their customers can work around this by disabling the requirement for signed binaries, but of course that's not desirable and in corporate environments might not be allowed.

I understand that. Just saying that when you word it as the certificate being revoked it's not immediately obvious that's a consequence of the developer account being banned. If the headline was "longtime Apple developer suspended" quite frankly I'd be much less interested, thinking it's a common occurrence.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#87

Post by raxxorrax » Tue, Aug 04, 2020, 2:56 PM UTC

epistasis wrote: post #76

raxxorrax wrote: post #66

Earlier quoted context omitted.

This will lead to computing being locked down further with really questionable benefits. In fact open source software can suffer greatly because these certs make deployment cost non-zero. So someone providing binaries of such software has to pay for it to large corps like Apple and Microsoft.

We've been in this situation for 10 years now. Has the slippery slope caused any sliding yet? The cost issue is separate from the revocation issue, and my point was about certain revocation--it's an absolutely great feature for any code signing situation where you are trusting others to compile code for you and others can't confirm that a certain set of binaries came from a certain set of source files. (Reproducible…

Eh, yes, we have much more locked down systems with reduced capabilities. Consoles used it maybe for years and they are notorious for being useless for any third party content. You cannot simply write your own drivers for several devices anymore, so you basically booted a lot of engineers. It infected whole industries. We have locked down agricultural devices where users pay for expensive hacks. It is a complete nightmare actually.

For security... sure... actually not even my grandmother would believe it.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#88

Post by acomjean » Tue, Aug 04, 2020, 2:56 PM UTC

dmix wrote: post #69

Reason077 wrote: post #59

The developer's website (software.charliemonroe.net) is also blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. I wonder if these things are related?

It has an app for downloading videos off YouTube and other video sites. Not sure how much influence media companies have in the UK but maybe that's why? I know YouTube downloading services have struggled in the past to stay operational.

Apple is a media company now. They aren't just distributing (like apple music) but are creating TV shows like Amazon and Netflix.

See Apple TV

I suspect this will bring about conflicts in the company between content creation and the hardware/software divisions.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#89

Post by AlexandrB » Tue, Aug 04, 2020, 2:58 PM UTC

yakz wrote: post #64

jtbayly wrote: post #4

Earlier quoted context omitted.

Is there something wrong with downloading videos to my computer?

It's against the YouTube terms of service. One characterization of this software is that it is designed to violate the YouTube terms of service. "The following restrictions apply to your use of the Service. You are not allowed to: access, reproduce, download, distribute, transmit, broadcast, display, sell, license, alter, modify or otherwise use any part of the Service or any Content except: (a) as expressly authoriz…

This doesn't really explain anything. Why is Apple enforcing YouTube's terms of service on a third-party application? Especially via a mechanism ostensibly designed to stop malware.

Is the Transmission torrent client next because it could be used to download copyrighted content?

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#90

Post by Reason077 » Tue, Aug 04, 2020, 2:58 PM UTC

mkathuri wrote: post #38

From the page: https://developer.apple.com/documentation/xcode/notarizing_m... > Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly. If there are no issues, the notary service generates a ticket for you to staple to your software; the notary service also publishes that ti…

The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content.

I don't think it's related to it being a "YouTube downloader" app either. There are many apps with this functionality and, so far as I can tell, none of the others are blocked.