Apple revoked longtime Mac developer's code signing certificate with no warning • Hacker News Board

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#151

Post by moogleii » Tue, Aug 04, 2020, 5:27 PM UTC

gruez wrote: post #24

beervirus wrote: post #21

Earlier quoted context omitted.

Isn't keeping the 30% on refunded apps bad practice, regardless of the justification? Well, yes, if it's true, which it wasn't.

Okay, so what are the situations where it can be false? * apple actually did communicate to them, but it was via carrier pigeon or something and it got lost * apple is under gag order * the developer is actually a long time repeat offender and is trying to evade via sockpuppet accounts None of them seem plausible to me. Also, unlike with the apple 30% refund fiasco, we know for sure this is happening, because other u…

> Okay, so what are the situations where it can be false?

I think many people ask themselves that just before they grab the pitchforks.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#152

Post by _qulr » Tue, Aug 04, 2020, 5:40 PM UTC

sjs382 wrote: post #30

gruez wrote: post #24

Earlier quoted context omitted.

Okay, so what are the situations where it can be false? * apple actually did communicate to them, but it was via carrier pigeon or something and it got lost * apple is under gag order * the developer is actually a long time repeat offender and is trying to evade via sockpuppet accounts None of them seem plausible to me. Also, unlike with the apple 30% refund fiasco, we know for sure this is happening, because other u…

It doesn't take much imagination to come up with other scenarios. No idea if any of these are true. * apple actually did communicate to them, but it went to the developer's spam box. * apple actually did communicate to them, but sent it to an old email address that the developer never updated. * apple actually did communicate to them, but it was via a developer dashboard that the developer rarely checks. * apple didn…

> apple actually did communicate to them, but it went to the developer's spam box.

Why are so many people assuming that Apple would only email a developer about revoking their certificate, a drastic action that suddenly kills all of the developer's apps? Apple has the phone number of every member of their developer program. Anything less than an immediate phone call from Apple in this situation would be gross negligence.

> apple didn't revoke it. something else is going on.

It's revoked. Any Mac user can verify this with "codesign --verify" on any of the apps on the developer's website that are still available for download.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#153

Post by throwaway12757 » Tue, Aug 04, 2020, 5:43 PM UTC

kps wrote: post #124

acomjean wrote: post #88

Earlier quoted context omitted.

Apple is a media company now. They aren't just distributing (like apple music) but are creating TV shows like Amazon and Netflix. See Apple TV I suspect this will bring about conflicts in the company between content creation and the hardware/software divisions.

Remember “Rip. Mix. Burn.”? Apple thinks different now.

When you are trying to capture a new market, it's best to be open.

After you have the market, you want to close the gates so no one else can have it.

The hypocrisy is real and why I no longer buy apple products.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#154

Post by LiNeXT » Tue, Aug 04, 2020, 5:55 PM UTC

echelon wrote: post #146

_qulr wrote: post #67

Earlier quoted context omitted.

Except that it's been verified by many people, and you can verify on your own Mac, that the developer's certificate has indeed been revoked, and the apps don't work. That part of the story is indisputable.

Honestly, no company should have this much control over people's businesses and livelihoods. iPhone is a generic pocket computer, and it has outgrown Apple's desire to maintain a fiefdom. Congress and the EU should force Apple to allow 3rd party marketplaces and installs. Apple is free to charge 30% for the App Store, but they can't be the only way to get code onto an iPhone. Nor should they be the only first class w…

This is actually why I completely left the Apple ecosystem. I ditched the iPhone for a LineageOS device and, since I think the Mac will eventually end up fully locked down as well, decided to get ahead of that race and migrate to Linux.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#155

Post by rbecker » Tue, Aug 04, 2020, 6:04 PM UTC

caymanjim wrote: post #102

raxxorrax wrote: post #11

Earlier quoted context omitted.

And platforms doing standing back flips to appease stupid legislation. Reminds me of YouTube blocking Blender videos... had other reasons though, don't remember exactly, but it had to do with them not monetizing their videos and really, really bad support.

If you think the legislation is stupid, blame the legislators. Companies have to abide by laws, even stupid ones.

They have to abide by them, not enforce them (unless a court order makes them). There's no law against distributing operating systems that allow running of programs that break the law.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#156

Post by reaperducer » Tue, Aug 04, 2020, 6:41 PM UTC

Reason077 wrote: post #90

mkathuri wrote: post #38

From the page: https://developer.apple.com/documentation/xcode/notarizing_m... > Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly. If there are no issues, the notary service generates a ticket for you to staple to your software; the notary service also publishes that ti…

The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. I don't think it's related to it being a "YouTube downloader" app either. There are many apps with this functionality and, so far as I can tell, none of the others are blocked.

This is strange as it does not appear to contain any adult content.

I've seen a number of times where a compromised web site will have a bit of javascript inserted into it that only shows the malicious payload to certain people from certain geographies or browsing history or operating systems, etc... It might be there, but not showing it to you.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#157

Post by reaperducer » Tue, Aug 04, 2020, 6:42 PM UTC

blibble wrote: post #141

Reason077 wrote: post #90

Earlier quoted context omitted.

The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content. I don't think it's related to it being a "YouTube downloader" app either. There are many apps with this functionality and, so far as I can tell, none of the others are blocked.

most of the internet is blocked by those mobile carrier content filters

In 20ish years of using the mobile internet, going back to WAP days, I've never visited a site that was blocked by a mobile carrier content filter.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#158

Post by CubsFan1060 » Tue, Aug 04, 2020, 6:46 PM UTC

echelon wrote: post #146

_qulr wrote: post #67

Earlier quoted context omitted.

Except that it's been verified by many people, and you can verify on your own Mac, that the developer's certificate has indeed been revoked, and the apps don't work. That part of the story is indisputable.

Honestly, no company should have this much control over people's businesses and livelihoods. iPhone is a generic pocket computer, and it has outgrown Apple's desire to maintain a fiefdom. Congress and the EU should force Apple to allow 3rd party marketplaces and installs. Apple is free to charge 30% for the App Store, but they can't be the only way to get code onto an iPhone. Nor should they be the only first class w…

I like everything going through Apple personally. In fact it's part of the reason I have an iPhone.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#159

Post by zepto » Tue, Aug 04, 2020, 7:32 PM UTC

pearjuice wrote: post #150

zepto wrote: post #132

Earlier quoted context omitted.

The downvotes are because we actually don’t known the full story. And of course there are benefits beyond lock-in. Do you know about the attestation service Apple has introduced? How would you build such a thing on your own?

Regardless of the full story, fact is that Apple (and many other owners of walled gardens) can revoke your access to it at a moment's notice without any explanation whatsoever. The reason for them doing this might be there but they owe you no explanation whatsoever. Some public outrage will put them in a position to make a statement or reconsider their decision. But you have no right to it.

All absolutely correct.

Outrage based on the facts is definitely something Apple should face.

However outrage based on lies is simply another evil.

People who are engaging in it are not doing any kind of public service - they are just adding more harm.

Re: Apple revoked longtime Mac developer's code signing certificate with no warning

#160

Post by the_af » Tue, Aug 04, 2020, 8:20 PM UTC

OskarS wrote: post #44

the_af wrote: post #35

Earlier quoted context omitted.

So a re-hash of the old "audio tapes will kill the music industry" or "video tapes will kill cinema"?

Nobody here thinks that the law is a good idea or will do anything to protect any content industries. The fact is that despite being enormously stupid, it is still the law.

Yes, I know I'm preaching the choir here. My point is that with each advance in technology, established industry "actors" panic because they foresee their business will go bankrupt. Sometimes this panic is justified, but often it's not, or it's blown out of proportion.

It's not necessarily the law, either. Panicky industry heavyweights may lobby to make it a law, or try to confuse a given tech with copyright infringement, but "downloading videos" is not against the law.