Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple revoked longtime Mac developer's code signing certificate with no warning

twitter.com

Post reply on HN
Print view View original

111–120 of 180 posts

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#111

Post by donarb »

AlexandrB wrote: post #89
yakz wrote: post #64

Earlier quoted context omitted.

It's against the YouTube terms of service. One characterization of this software is that it is designed to violate the YouTube terms of service. "The following restrictions apply to your use of the Service. You are not allowed to: access, reproduce, download, distribute, transmit, broadcast, display, sell, license, alter, modify or otherwise use any part of the Service or any Content except: (a) as expressly authoriz…

This doesn't really explain anything. Why is Apple enforcing YouTube's terms of service on a third-party application? Especially via a mechanism ostensibly designed to stop malware. Is the Transmission torrent client next because it could be used to download copyrighted content?

It's right here in the App Store guidelines:

5.2.3 Audio/Video Downloading: Apps should not facilitate illegal file sharing or include the ability to save, convert, or download media from third-party sources (e.g. Apple Music, YouTube, SoundCloud, Vimeo, etc.) without explicit authorization from those sources. Streaming of audio/video content may also violate Terms of Use, so be sure to check before your app accesses those services. Documentation must be provided upon request.

https://developer.apple.com/app-store/review/guidelines/#int...

As to the why, because Apple could be sued by third parties for allowing this behavior for apps that Apple has vetted.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#112

Post by gowld »

Reason077 wrote: post #90
mkathuri wrote: post #38

From the page: https://developer.apple.com/documentation/xcode/notarizing_m... > Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly. If there are no issues, the notary service generates a ticket for you to staple to your software; the notary service also publishes that ti…

The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. I don't think it's related to it being a "YouTube downloader" app either. There are many apps with this functionality and, so far as I can tell, none of the others are blocked.

Could also be caught sharing an IP range with a banned website :-|

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#113

Post by jhasse »

vbezhenar wrote: post #31
CodeWriter23 wrote: post #6

Earlier quoted context omitted.

> Is there something wrong with downloading videos to my computer? Nope. Creating a tool perceived by those with enough lawyers to be a “copy protection circumvention device” however does run afoul of the DMCA.

Why does Apple care? It's none of their business.

iTunes and Apple TV+?

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#114

Post by planb »

swiley wrote: post #93
epistasis wrote: post #76

Earlier quoted context omitted.

We've been in this situation for 10 years now. Has the slippery slope caused any sliding yet? The cost issue is separate from the revocation issue, and my point was about certain revocation--it's an absolutely great feature for any code signing situation where you are trusting others to compile code for you and others can't confirm that a certain set of binaries came from a certain set of source files. (Reproducible…

> Has the slippery slope caused any sliding yet? Yes it has, that’s the point of this whole discussion. Desktop apps now need to be signed and I’d be willing to bet you couldn’t find a signed torrent client.

Why would you be willing to bet if you just can google that the transmission BitTorrent client is in fact gatekeeper-signed?

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#115

Post by ashtonkem »

swiley wrote: post #56

In other words: you can’t depend on signed mac apps for anything important as a user even if they keep everything local to your computer. The developer could do something completely unrelated and your app will suddenly stop working with no warning.

And you can flip a single switch and keep running it? So?

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#116

Post by gowld »

veidr wrote: post #52

I feel bad for the developer. But every time I see stories like this, I also feel a little jolt of validation regarding my choice as a developer to leave the Apple ecosystem in 2008. At the time, the App Store (iOS) was new, and I was working on porting our SSH-based encrypted remote access tool[1] from Mac to iPhone. I had been doing mainly Mac OS X development for almost 10 years. I had the proof-of-concept port fr…

Big companies can't avoid following being caught violating the law as easily as micro operations.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#117

Post by ben509 »

swiley wrote: post #56

In other words: you can’t depend on signed mac apps for anything important as a user even if they keep everything local to your computer. The developer could do something completely unrelated and your app will suddenly stop working with no warning.

Which it should. If Apple detects that there's a problem with a cert, they should revoke it.

Presumably, there's a known problem and something isn't working, even if it looks like it is.

Arguably, it'd be nice to have a facility (assuming it doesn't already exist) to override the revocation list, but designing that it isn't bypassed by social engineering is tough.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#118

Post by justinclift »

hunter2_ wrote: post #28
jabroni_salad wrote: post #9

Earlier quoted context omitted.

Personally I would say no but it does kind of depend. Tools like this do allow you to save copies of videos that weren't meant to be savable. The dev's website includes a screenshot of it downloading a bunch of Disney material. That is not a wasp nest I want to shake.

Broadcast and cable TV wasn't meant to be savable, and then VCRs came out and courts decided that saving (time shifting) is absolutely fine. It doesn't in and of itself facilitate sharing. If it breaks actual encryption (a la DeCSS) then yes, it oversteps. But TV content stakeholders don't have much pull with convincing VCR manufacturers/distributors to stop supplying VCRs. Apple does clearly have the ability to affe…

> If it breaks actual encryption (a la DeCSS) then yes, it oversteps.

Don't some jurisdictions have provisions that allow for technical workarounds in order to make backups?

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#119

Post by gowld »

richardwhiuk wrote: post #92
AnthonyMouse wrote: post #65

Earlier quoted context omitted.

> Surely by moving the goalposts you can make everything look like a monopoly. Walmart doesn't have a monopoly on SAE 5w30 motor oil. You can't make it look like a monopoly when it isn't one, because when it isn't you can identify competitors who sell substitute products to the same customers. > In the end both mobile platforms have practically the same popular apps. The market they have a monopoly on is iOS app stor…

Walmart has a monopoly on being the only people who can sell products in a Walmart store.

Switching from Walmart to Target and back and forth all day long is much easier than switching between phones.

A phone is a natural monopoly.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#120

Post by _qulr »

charliemil4 wrote: post #97
cdubzzz wrote: post #83

Earlier quoted context omitted.

Sure but the important part of the tweet is “with no warning”. That’s why it is being posted here.

Apple sends out emails about a month before your certificate expires - I bet they didn’t check it and/or thought the expiry would only apply to new builds *replaced pronouns and specified

The certificate was revoked, not expired. And expired code signing certs don't prevent Mac apps from running, they just prevent new builds from being signed.

$ codesign --verify ~/Downloads/Eon_977.dmg

CSSMERR_TP_CERT_REVOKED

Post reply on HN