Another solution that is not mentioned in the article is that users of both macos and windows should be able to easily integrate the certificate of a third-party editor, with a process integrated in their OS explaining the risks, but also making it a process that can be understood and trusted, so that editors can self-sign their own binaries at no cost without needing the approval of the OS editor. Such a tool should ideally be integrated in the OS, but ultimately it could also be provided by a trusted third-party.
Microsoft will upload these executables to the cloud by default if you use their antivirus engine ("sample collection").
In a way, Microsoft is building the same "notarisarion database", but it's doing so after executables have been released rather than before it. Many vendors and developers will likely add their executables to that "database" by simply running it on a test system.
On the other hand, SmartScreen can be disabled pretty easily, whereas macOS doesn't offer a button to disable notarisarion.
You don't even need signing for Microsoft's system to do what it does - it can operate on unsigned code, it's all hash based.
Or really any reason. They're not supposed to exert editorial control but that's how it has been happening in practice.
How often do you notarize your apps? Why does the speed matter at all? In my cases it takes 2 seconds for the notarization to complete.
There's obviously simple cases where the iOS notorization also flies in 2 secs, but there seems to be enough tougher cases:
https://www.reddit.com/r/iOSProgramming/comments/1l9m7jd/how...
https://9to5mac.com/2024/06/19/iphone-pc-emulator-block-ille...
In practice though they use it to turn the screws on various API compliance topics, and I'm not sure how effective it is realistically in terms of preventing malware exploits.
In the end we went with Digicert Keylocker to handle the signing, using their CLI tool which we can run on Linux. For our product we generate binaries on the fly when requested and then sign them, and it's all done automatically.
Notarization is only needed when distributing binaries to others. Personally I do it once a month for the Mac app I distribute.
The post I wrote to point people at anyway:
moi2388•5h ago
Propelloni•4h ago
MagicMoonlight•4h ago
Nobody else would bother. That’s why meme language repositories continuously lead to hacks and vulnerabilities.
rkomorn•4h ago
BoredPositron•3h ago
rkomorn•3h ago
BoredPositron•3h ago
aeonfox•2h ago
[0] https://appstoreconnect.apple.com/WebObjects/iTunesConnect.w... [1] https://developer.apple.com/support/downloads/terms/apple-de...
All the relevant agreements can be found here, so if there's something that specifies this kind of overreach, I'd both be very surprised and interested.
https://developer.apple.com/support/terms/
BoredPositron•2h ago
rkomorn•2h ago
Edit: oh, are you saying that such requests would be "Apple confidential information" so nobody would say if it happened?
robertclaus•4h ago
realusername•3h ago
Right now you have a lot of piracy apps which are disguised as a "note taking app" and they passed the appstore review without any issues.
heinternets•2h ago
moi2388•2h ago
Which is exactly as it should be
whatsupdog•2h ago
owisd•1h ago
lanyard-textile•1h ago
djantje•4h ago
realusername•3h ago
wiseowise•3h ago
noir_lord•2h ago
I actually don't have (much) of an issue with walled garden approaches as long as the wall has a gate that is easily opened, give me an OS level toggle with a warning of "Here be dragons" and I can live with it - it's not ideal but it's not a terrible trade off.
It's something Android has had previously (but they seem to be trying to lock that gate) and iOS less so.
graemep•1h ago
brabel•45m ago
rogual•2h ago
owisd•1h ago
saubeidl•2h ago
gregoriol•2h ago
We also can't count on every person being able to check every single thing they do: how do you check if some food or drug you get is good or not? you can't really, you have to trust someone who knows.
saubeidl•2h ago
Yes - the democratically elected government, not a monopolistic entity with capital interest.
userbinator•1h ago
owisd•1h ago
tacker2000•1h ago
Its a smokescreen.
You want less liberty because of the “least competent” user?
tgv•1h ago
A phone/tablet is a tool, with very intense usage, and huge privacy value, not an engineer's toy.
idle_zealot•20m ago
Ray20•2m ago