Hacker News Reader

Comment by Karliss | Hacker News Reader

If Apple didn't want scan every binary submitted for notarization then they didn't need to introduce the notarization. They already had the means to revoke malicious binaries after-the-fact by revoking the corresponding developer certificate. The main difference with notarization is that it forces binaries to be submitted to Apple early for inspection in comparison with signing using developer certificate which happens locally.

View on HN

Moreover, they've had the ability to "revoke binaries" before notarization was a thing. There's a small antivirus scanner that runs on every app you download and on every dmg you mount, and shows a very scary warning if it detects known malware.

Wouldn’t you also want the ability to revoke just certain binaries? Let’s say a large company like Microsoft accidentally somehow got malware on their Excel app, you wouldn’t want to terminate the dev cert because that would also cancel Outlook, Word, PowerPoint, etc

If I'm not mistaken you can create as many code signing certificates as you want, so it makes sense to sign each application with its own certificate. Of course this wouldn't help when Apple "kills" the entire developer account I guess.

Nope, you can only generate 5 Developer ID Application certificates for the lifetime of your Developer account. It's a real pain to get another one, I had lost all of mine (didn't have a real Mac, so was using various temporary Hackintosh and KVM installs) and it took 2 months of emails to both Developer support and the Security team to get another one issued [and backed up].

It took you five times before you learned to make backups? Woah.

That's a bit condescending. The signing stack is very complicated and folks often make mistakes when attempting to back up (export) the correct private key and certificate pair.

I admit it was foolish, but this was over 3 years and I didn't know there was a limit on the number of certificates you could generate.

That's what XProtect is for

> They already had the means to revoke malicious binaries after-the-fact by revoking the corresponding developer certificate

That's a big hammer because it breaks everything that was ever signed with the certificate.

That's fine with me - if the developer was caught with one malware-infected app, I would worry about the other malware they shipped that wasn't caught.

Not true. They can make the certificate invalid after a certain date, while still allowing software signed before that date. This happened when Panic lost their signing certificate.

Reply on news.ycombinator.com