21–30 of 35 posts
In the past, things like this used to be done for signing certificate rollovers.
> When analyzing the code of one of the apps that received an Apple update, MacRumors could not find what had changed.
Unfortunately, it's put so vaguely, it could either mean the diff showed no code changes - or they were unable to compute a diff, for whatever reason.
If it's the former, that would be a strong indication for certificate issues, I think.
Earlier quoted context omitted.
This seems utterly pointless to worry about. You're fucked either way if you trust VLC.
Care to elaborate?
hmm, my money is on some actively used 0-day exploit that Apple is sealing shut before the CVE gets announced. By the looks of the app list, they seem to be apps and games that used to be popular and have fallen in disrepair and apps that are starved of maintenance attention. On the one hand it could be an exceptionally good example of "stewardship"; on the other hand, if this is true, what if authorities could later…
Neither developers nor consumers should be comfortable with this, as this breaks the trust model and is extremely worrying. The site is of course downplaying it given its name, which is a huge shame.
And this is part of the agreement between an app developer and Apple; for a long time now, a developer doesn't upload a full compiled app to Apple, but a package containing partially compiled (itermediary language) code and assets for many different platforms and resolutions, leaving it up to Apple to do the final assembly based on what device it downloads. This allows them to (re)compile for newer hardware, 32 vs 64 bit CPUs, save bandwidth and storage space by only having the device download the assets for its device (and for e.g. games the assets for the level they are playing at that time), etc.
So again, what trust model are you thinking of? Apple is a trusted party when it comes to this, I'd even argue they're more trustworthy than the app developers themselves.
Earlier quoted context omitted.
Care to elaborate?
It's downright trivial to hide a backdoor in a codebase like this.
That is, I'm calling you out for fearmongering, for a possible what-if, but given how popular VLC is you'd think it would've happened / is actively happening already. And there is no evidence for that.
If Apple is distributing modified vlc binaries without releasing the source of the changes when requested, is that a potential legal problem?
I don't believe an iOS distribution specific certificate falls under the license you're referring to, but I'm no expert on these matters.