Hacker News Reader

> Imagine an ecosystem where apps were signed with domain validated certificates, which would be free (or very cheap), instant, and better than what we currently have, and it definitely feels like entrenched interests are working to keep things from improving.

The goal is to validate and associate a legal entity with a developer account, not a domain name.

In addition to being required to do such things in many jurisdictions for tax reasons, in event of subsequent abuse the stores want to ban an organization - not a $10 domain name.

    in event of subsequent abuse the stores want to ban an organization

A corporate shouldn't get to be the gatekeeper of anything - regulators / courts in a democratic system should decide such things so that the corporates can't abuse their position against a smaller entity. And CAs should be held accountable by the regulators too - a simple regulation like asking CAs to collect legal ID and certificate of registrations before issuing certificates to any person or entity can take care of this. Thus, if any illegal ill-practice is detected in any software, the regulators or the law can be informed and the developer / entity easily identified and necessary legal action can be taken.

I know this is old, but...

> The goal is to validate and associate a legal entity with a developer account, not a domain name.

I'm saying that goal has failed. Setting up a company has a low, fixed cost for bad actors and there's plenty of malware signed by EV code signing certificates.

> not a $10 domain name

IMO domain names are worth a lot more than $10 once you start building a brand on them. For example, cars.com values their domain at $800 million dollars [1]. Obviously they couldn't sell it for that, but that's what they consider the brand value to be.

I can start a "legal entity" for much, much less than the value I attribute to my domain. For small developers and good actors, I think being able to build identity around a domain based brand would be useful.

Or, if it's _really_ about accountability, all code signing certificates should be issued to individuals who have validated their identity through a notary. And not using the terrible system the current CAs are using where some poor bastard in a developing country is expected to verify identity documents from a bajillion different legal jurisdictions.

I guess I just hate the high pricing and terrible, terrible product that code signing certificates have become.

1. https://domaingang.com/domain-news/cars-com-domain-was-value...

Apple markets to non developers, by advertising to the masses, it forces us to join to partake with the masses.

I've been lucky enough to avoid the walled prison but a fortune 500 company cannot.

We can only educate the masses that better products exist or the psychology tricks Apple uses in their marketing.

> My exact sentiment at the time was "there's no way developers are going to be dumb enough to give up control of distribution." Wow, was I ever wrong :-(

You were only one word off the truth if s/developers/consumers.

Yes, artificial monopoly is the major issue here.

With respect to the "$99" annual fee, the issue is that it isn't a good deal at all when a developer wants to offer the software for free - most open source developers don't even collect any donation, and it is doubtful if many of them can even raise $99 every year.

This is where regulation is definitely needed - big tech should not be able to force us to pay and use only their signing infrastructure, and government law should require any CA to stringently implement KYC (know your customer) norms, like banks do, before issuing certificates to any Tom, Dick or Harry.

I would preferably like to see the end of such "App Store" nonsense, but would gladly compromise and accept it if there is no monopoly (with the caveat that side loading / direct installation of apps should not be restricted - nobody should be forced to use an "App Store" if they don't want to).

(App Store is so successful on ios only because side loading / direct installation is restricted on it).

Even they show now popup and permission on mac. It made lots of app and developers living miserable. They are showing popups for permission every where.

Thats why there is no income now for indie developers in appstore