Apple revoked longtime Mac developer's code signing certificate with no warning

https://twitter.com/charlieMonroe/status/1290509083288764428

by _qulr • 6 years ago

203 163 6 years ago

twitter.com

_qulr7• 6 years ago

"We’re a small family business making apps for iOS and macOS." https://software.charliemonroe.net/

lqet• 6 years ago

I suspect this is why:

Ever wished you could save a video from the Internet? Search no more, Downie is what you're looking for. Easily download videos from thousands of different sites.

jtbayly• 6 years ago

Is there something wrong with downloading videos to my computer?

JOnAgain• 6 years ago

Unfortunately

CodeWriter232• 6 years ago

Is there something wrong with downloading videos to my computer?

Nope. Creating a tool perceived by those with enough lawyers to be a “copy protection circumvention device” however does run afoul of the DMCA.

jabroni_salad• 6 years ago

Personally I would say no but it does kind of depend. Tools like this do allow you to save copies of videos that weren't meant to be savable.

The dev's website includes a screenshot of it downloading a bunch of Disney material. That is not a wasp nest I want to shake.

tclancy• 6 years ago

No, it's more that it's easy to guess the likely cause here:

* a lawyer sends a DMCA request to Youtube

* a Youtube bot looks at the offending request and finds a user agent

* Kicks off automated warning to Apple bot

* Apple bot shuts down developer account

All that's really needed here is a bot to post these things to Twitter and HackerNews and then an API for the service bots to read the complaints and undo the action with a phony apology post

yakz• 6 years ago

It's against the YouTube terms of service. One characterization of this software is that it is designed to violate the YouTube terms of service.

"The following restrictions apply to your use of the Service. You are not allowed to:

    access, reproduce, download, distribute, transmit, broadcast, display, sell, license, alter, modify or otherwise use any part of the Service or any Content except: (a) as expressly authorized by the Service; or (b) with prior written permission from YouTube and, if applicable, the respective rights holders;"

- https://www.youtube.com/static?gl=CA&template=terms

robterrell• 6 years ago

Apple might think so! I had a popular YouTube downloader app for Mac OS and I spent a lot of time on a port for iOS, but it was rejected from the app store back in 2010. The app reviewer did call me on the phone to tell me -- in fact, she called twice, once to tell me that my app was going into an extended review, and then a few weeks later she called to tell me that my app had been rejected. When I asked what the reason was, she told me to check the review guidelines ("check them again now" she said) and lo and behold, they had added a new guideline about downloading media without explicit IP rights. Moving the goalposts, one app at a time!

luxuryballs• 6 years ago

"downie"? could it just be the name? https://www.urbandictionary.com/define.php?term=Downie

though if it was that you'd think they would just pull the app and ask him to rename it...

tonyedgecombe2• 6 years ago

Looking at his website I don't think it is even in the store. What he names it is really none of Apple's business unless it infringed on one of their trademarks.

rasz2• 6 years ago

Is it by any chance a straight port of youtube-dl? This and

The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content.

would explain a lot. In order to download from a pr0n website you need to hardcode that websites domain name inside the program = pr0n filters pick it up = Apple bans it.

staplers• 6 years ago

I suspect it has something to do with Apple wading into content publishing and the alliances it would strengthen to suppress even suspected piracy.

pearjuice2• 6 years ago

Sadly, this is what a walled garden results in. Please don't be surprised, shocked or even remotely discontent because by signing the ToS you have waived away any and all of your rights regarding the use and publishing of software in this walled garden. The only reason an issue like this will get "fixed" is when this (post/tweet) goes viral and the PR department will work extra hard to correct this.

raxxorrax9• 6 years ago

Don't know why you are downvoted since you are completely correct. It is unfair to the developer but we wouldn't even have this discussion if people rejected app stores.

I like that more developers just reject software certification processes. There is zero benefit aside from lock in.

coldcode• 6 years ago

Other than open season on the users with malware out the wazoo. But who cares about security. Do you buy healthcare from the back of a pickup truck?

elliekelly5• 6 years ago

As a developer it’s a pain but as a user it’s definitely useful for security purposes. It’s hardly “zero benefit”.

matwood• 6 years ago

Someone said there are security benefits to the user. Obviously nothing is 100%, but there is a benefit. There’s also discovery benefits to both sides and trust benefits. I am find apps more easily on app stores, and am much more quick to buy an app through the store then some random website.

Maybe those benefits don’t outweigh the downsides, but to say there is no user or developer benefit is objectively false in both cases IMO.

zepto8• 6 years ago

The downvotes are because we actually don’t known the full story.

And of course there are benefits beyond lock-in.

Do you know about the attestation service Apple has introduced?

How would you build such a thing on your own?

ben5093• 6 years ago

The app store concept is fine, we need a separation of concerns. These are all things I'd rather pay someone else to do:

1. A standard format and tools for code signing.

1b. Actively validating or rejecting code on the end user machine.

2. Purchasing and delivery of software.

3. Trust of code blobs.

They just don't need to be all handled by your OS vendor.

DethNinja• 6 years ago

Another option would be changing the legislation. I wouldn’t hold my breath in the case of USA but rest of the world should certainly limit the monopoly of walled gardens as it limits the competition.

bzb32• 6 years ago

Apple is not a monopoly.

Additionally this is a Mac app and you can sideload apps on Macs

veidr3• 6 years ago

WTF. I dare any one of you who downvoted this to explain why in public.

rimliu4• 6 years ago

Because it is a lot of hand-waving bullshit. This "walled garden" talk gets tiring fast. And, uh oh, big surprise, you have to actually behave according to ToS you signed. How can it be, hmmm? Nobody forces you to sign anything. Go have your own platform and distribution chanells. Oh, you want to be where the money is? Well, than. Maaaaybe there is some correlation between being the walled garden and the place there the money is?

diego_moita• 6 years ago

HN is an Apple fan club.

Most people here are from Silicon Valley and Apple is the biggest employer over there.

Try to badmouth Samsung in a Korean sub and you get the same treatment.

Tijdreiziger• 6 years ago

A few tweets down that thread:

Non-notarized versions will not work well on newer systems (https://appleinsider.com/articles/19/12/23/apple-will-enforc...) and mainly I can't currently even compile the application.

CubsFan10602• 6 years ago

Perhaps we should wait to get the whole story to discuss. Didn't we just go through this with the "Apple doesn't return 30% on refund" fiasco last week?

gruez4• 6 years ago

Isn't silently revoking a longtime mac developer's certificate bad practice, regardless of the justification?

beervirus• 6 years ago

Isn't keeping the 30% on refunded apps bad practice, regardless of the justification?

Well, yes, if it's true, which it wasn't.

michaelt• 6 years ago

If their certificate had been stolen it would be expected. Stolen code signing certificates have been used to distribute malware in the past; for example Stuxnet.

Of course, you'd expect a notification from Apple saying they'd done that and why; and plenty of safety measures to prevent mistaken revocations.

That's not to say I support mandatory code signing - merely that if you're going to have code signing, you also need to revoke stolen certs.

swiley3• 6 years ago

Honestly it doesn’t matter at all if it actually happened, that they could is unacceptable.

EDIT: To be clear, it's not the certificate revocation that's bad, it's that the certificate is required to distribute code and can only be acquired from a single organization.

epistasis3• 6 years ago

I think certificate revocation of signed code is a good, useful feature and something that I want as part of my security infrastructure.

I wouldn't want it any other way if I have to use non-open source code that I can't inspect. But the basis of all my core software is going to be open source.

ashtonkem3• 6 years ago

I actually like code signing. I can still run unsigned code by flipping the right setting, but I don’t have to worry about non-developer family members running something bad.

_qulr7• 6 years ago

Except that it's been verified by many people, and you can verify on your own Mac, that the developer's certificate has indeed been revoked, and the apps don't work. That part of the story is indisputable.

cdubzzz• 6 years ago

Sure but the important part of the tweet is “with no warning”. That’s why it is being posted here.

echelon2• 6 years ago

Honestly, no company should have this much control over people's businesses and livelihoods.

iPhone is a generic pocket computer, and it has outgrown Apple's desire to maintain a fiefdom.

Congress and the EU should force Apple to allow 3rd party marketplaces and installs. Apple is free to charge 30% for the App Store, but they can't be the only way to get code onto an iPhone. Nor should they be the only first class way of doing it.

Edit: I frequently get downvotes because of this. Who really wants everything going through Apple 100% of the time? I don't understand this perspective at all. Do you like not having control of your devices?

mkathuri• 6 years ago

From the page: https://developer.apple.com/documentation/xcode/notarizing_m...

Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly. If there are no issues, the notary service generates a ticket for you to staple to your software; the notary service also publishes that ticket online where Gatekeeper can find it.

Perhaps the software connected to a website that was flagged as malicious by Apple. That’s one way I could see it getting flagged.

Reason0777• 6 years ago

The developer's website (software.charliemonroe.net) is blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content.

I don't think it's related to it being a "YouTube downloader" app either. There are many apps with this functionality and, so far as I can tell, none of the others are blocked.

gowld3• 6 years ago

Could also be caught sharing an IP range with a banned website :-|

blibble• 6 years ago

most of the internet is blocked by those mobile carrier content filters

reaperducer2• 6 years ago

This is strange as it does not appear to contain any adult content.

I've seen a number of times where a compromised web site will have a bit of javascript inserted into it that only shows the malicious payload to certain people from certain geographies or browsing history or operating systems, etc... It might be there, but not showing it to you.

sschueller• 6 years ago

How long until you will no longer be able to install unsigned apps on your mac?

auganov2• 6 years ago

Original tweet:

"Hello everyone, today I woke up to my developer account being suspended without a single letter why which is why the apps are crashing. Please bear with me while I try to get this fixed with Apple. Thank you for understanding."

Not being a Mac developer, the wording about revoking the certificate makes it sound a little more unusual than just their account being banned. Although not nice, I assume that's something that happens a lot.

simonh• 6 years ago

The developer's account is liked to the certificates used to sign their app binaries. If MacOS is set to only allow signed binaries to run, that means this developer's app binaries won't run.

Their customers can work around this by disabling the requirement for signed binaries, but of course that's not desirable and in corporate environments might not be allowed.

auganov2• 6 years ago

I understand that. Just saying that when you word it as the certificate being revoked it's not immediately obvious that's a consequence of the developer account being banned. If the headline was "longtime Apple developer suspended" quite frankly I'd be much less interested, thinking it's a common occurrence.

veidr3• 6 years ago

I feel bad for the developer. But every time I see stories like this, I also feel a little jolt of validation regarding my choice as a developer to leave the Apple ecosystem in 2008.

At the time, the App Store (iOS) was new, and I was working on porting our SSH-based encrypted remote access tool[1] from Mac to iPhone. I had been doing mainly Mac OS X development for almost 10 years.

I had the proof-of-concept port from Mac to iOS working, but the amount of insane hoops I had to jump through (because it used "strong encryption" (we forked PuTTY SSH)) seemed, initially, like a trip the DMV. It gradually started feeling more like the movie Brazil.

I remember going directly from WWDC to the local office of (searches old files) the "Bureau of Industry and Security" (wat) and talking to some guy who had NO idea what I was talking about when I told him my company was trying to make an iPhone app that used encryption and that Apple had told me I needed to get his agency's approval. (Nice guy, though.)

Ultimately, working through the Apple documentation, I learned I had to do a bunch of weird stuff, like sign up for antique government systems that only worked on Windows XP, and provide personal info, and make a PIN, and submit an application to SNAP-R, and submit a "BIS-748P supporting document: how the Product meets the criteria of the Cryptography Note as mass market encryption software" along with a "BIS-748P supporting document: additional information to supplement our application for review and commodity classification request, in accordance with Supplement No. 6 to Part 742 of the EAR" along with "BIS-748P supporting document: sample marketing copy and brochure text" and a "BIS-748P supporting document: illustrations depicting the software in operation" and then finally a "BIS-748P supporting document: source code listings for all encryption-related source code used in the product"... that last was a ridiculous 500-page or so hard copy printout of the source code to PuTTY with the few dozen places we'd changed it (to make it multithreaded to fit better with our app architecture, haha, because I was young and dumb then).

And, while I forget a lot of the details (I've just copy-pasted those now, after finding the relevant old files), I remember vividly the moment, sitting there in a Tokyo hotel business center assembling this heavy paper package to FedEx to BIS and just suddenly thinking... wait though — maybe this isn't a game I want to play. We didn't have to do any of this to ship a Mac app — any risk of legal noncompliance was ours, of course, but in reality there was no actual risk. This was all for Apple to cover their ass.

If some government bureaucrat didn't like my application, my app wouldn't ship and the past year of work would be for nothing. And somehow that made me acutely aware that the same thing would be true if Apple for some reason didn't like my app. Like... what if they were planning to roll out similar rich, Mac-centric remote access features in the next OS update. Or, even if they approved it, but later just didn't want to deal some issue that arose around it — they could just revoke my app any time they pleased.

(As seems to be the case with the app in this thread.)

I thought about this for a couple more weeks, and then I took a corporate job doing internal systems development. The app was never finished.

The lack of my app obviously didn't hurt Apple. But looking back, I do feel like the lack of having to deal Apple — and that whole weird power imbalance, of being a peasant plowing fields owned by Apple, hoping to receive some part of the fruits of my labor — probably helped me live a more serene, untroubled life.

[1]: iGet Touch (phone apps were still called "blah blah Touch" then, just like many Mac apps from the early 2000s were idiotically prefixed with "i" (^_^); back then) was never finished — but it was basically a native iOS version of the Mac version, long dead but still archived here: http://nakahara-informatics.com/iget

gowld3• 6 years ago

Big companies can't avoid following being caught violating the law as easily as micro operations.

swiley3• 6 years ago

In other words: you can’t depend on signed mac apps for anything important as a user even if they keep everything local to your computer. The developer could do something completely unrelated and your app will suddenly stop working with no warning.

ashtonkem3• 6 years ago

And you can flip a single switch and keep running it? So?

ben5093• 6 years ago

Which it should. If Apple detects that there's a problem with a cert, they should revoke it.

Presumably, there's a known problem and something isn't working, even if it looks like it is.

Arguably, it'd be nice to have a facility (assuming it doesn't already exist) to override the revocation list, but designing that it isn't bypassed by social engineering is tough.

Reason0777• 6 years ago

The developer's website (software.charliemonroe.net) is also blocked by my ISP (Vodafone UK)'s adult content filter. This is strange as it does not appear to contain any adult content.

I wonder if these things are related?

dmix2• 6 years ago

It has an app for downloading videos off YouTube and other video sites. Not sure how much influence media companies have in the UK but maybe that's why?

I know YouTube downloading services have struggled in the past to stay operational.

Reason0777• 6 years ago

I don't think so. There are many "YouTube downloader" type apps, and none of the others are blocked as far as I can tell.

acomjean• 6 years ago

Apple is a media company now. They aren't just distributing (like apple music) but are creating TV shows like Amazon and Netflix.

See Apple TV

I suspect this will bring about conflicts in the company between content creation and the hardware/software divisions.

rasz2• 6 years ago

other video websites being pr0n by any chance? woul require shipping their domain names inside binary, might not make Apple all that happy

ttepasse• 6 years ago

Just wondered: If the adult content filter is ISP-level, can you deactivate it or like in this case report false positives?

It sound's as orwellian as Apples certificate shenanigans.

Reason0777• 6 years ago

You can deactivate it by verifying your age with a credit card or photo ID. Vodafone don't seem to offer a way to report false positives, but I've seen that option with other providers.

elliekelly5• 6 years ago

I’m so curious how this even works? Do all ISPs in the UK have an adult content filter on by default?

kogir• 6 years ago

Interesting that a few of the apps were also (voluntarily?) pulled from the developer’s website, so we can’t inspect them.

kenferry• 6 years ago

This seems relevant.

“MPlayerX hasn’t been working for almost a year now. Also they still offer my apps on the App Store, they revoked my (direct) distribution certificate...”

https://twitter.com/charliemonroe/status/1290629792430280704...

HeavenFox• 6 years ago

MPlayerX was caught bundling installer with malware: https://www.reddit.com/r/apple/comments/3bhvh9/psa_do_not_in...

So this could be justified

floatingatoll• 6 years ago

(5 years ago)

planb2• 6 years ago

Another possible explanation: The developer‘s certificate leaked and was really used to sign malware. Or his github repo was hacked and something evil was added to his code without him noticing. Maybe I’m just rationalizing, because if Apple is really going down the road that most commenters here suspect, then there will be no arm macbook for me unfortunately... :(

_qulr7• 6 years ago

When this actually happened in the past, Apple worked closely with the developer: https://panic.com/blog/stolen-source-code/

ben5093• 6 years ago

So, that's plausible, and I'm trying to wrap my head around the operational model of signed software. Apple has plenty of docs about it [1] [2] [3] but never really get into "how does this work in the long run when things fail" beyond blithely noting that users won't be able to run your stuff and a host of services will start to fail.

A CRL / OSCP makes sense, more or less, for websites as they can simply abandon a cert.

If the cert leaks, is the remedy really to completely blacklist the certificate? Because that means that anyone who is able to steal the cert can effectively blackmail an author.

I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases.

I can't imagine how they don't have a separation of concerns given that app certificates must expire.

[1] https://developer.apple.com/support/certificates/

[2] https://help.apple.com/developer-account/#/dev138c9fac7

[3] https://developer.apple.com/library/archive/documentation/Se...

_qulr7• 6 years ago

I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases.

Yes, this is definitely possible, and why Developer ID signing has a secure timestamp, as specified by the --timestamp flag to the /usr/bin/codesign tool.

When Panic's code signing cert was stolen, they revoked it after a certain date, but old versions of their apps continued to be valid and pass Gatekeeper.

_qulr7• 6 years ago

Update from the developer: https://blog.charliemonroe.net/a-day-without-business/

"after almost 24 hours after 10PM, I got my account re-instated. Apple has called and apologized for the complications. The issue was caused by my account being erroneously flagged by automated processes as malicious and was put on hold."

Apple revoked longtime Mac developer's code signing certificate with no warning

Related Stories