6 ms·
Except it won't show for signed+notarized apps. It's just a minor obstacle to deliver malware. Even stuff on App Store has malware in it. If security was a con
by jezek2 1mo ago
Except it won't show for signed+notarized apps. It's just a minor obstacle to deliver malware. Even stuff on App Store has malware in it.
If security was a concern, these hoops would be for all apps, not just unsigned. It just shows the only function it serves is gatekeeping by Apple.
- anonreplier 1mo agoand when malware is discovered in the rare case of signed apps signing can be revoked
- AnthonyMouse 1mo agoSignature revocations are functionally equivalent to malware definitions and correspondingly don't actually require code signing.
- simondotau 1mo agoExcept that it's easier to invalidate an entire signing certificate than to hope your malware definition satisfies all mechanically generated permutations of the malware.
- AnthonyMouse 29d agoHow does that help you when the malware authors can get more signing certificates the same way they got the first one? Notice that this is easier for malware authors to do than ordinary people because their business is compromising others' machines, so then they can use the signing keys of any victims who have a developer account, or sign up for new ones using stolen cards from any of the victims. Meanwhile you would then have Apple revoking the victims' signing certificates and screwing their honest users who can now no longer install the non-malicious software they previously released. The entire premise is a scam to extract an annual fee from a million small developers.
- anonreplier 23d agoYou know what's even easier than getting a signing certificate for malware? Not bothering with signing at all. And revoking a cert for one "dev" does not mean revoking everything, as for them stealing signing keys from other devs (not typical users, but security literate) how often does that happen, especially in the case of apple with sandboxing etc?