Hacker News new | past | comments | ask | show | jobs | submit
brookst | on: Apple's git still trusts the compromised eMudhra certificates
I don't know about worse. Imagine a world where there is no OS authority, each app does their own. Do you think all important apps would be updated in 10 days, including auto-updates?

Apple fucked this up, but I really don't think the situation is "as bad if not worse" than if MacOS just didn't do this.

mikepurvis | parent | next
Isn't that the world that Docker gives us, basically?
loading story #50275554
lakeviewterrace | parent | next
> Imagine a world where there is no OS authority, each app does their own.

That's the world we live in now thanks to Google and Mozilla.

emn13 | root | parent
Surely there's a nuanced difference between "every app distributes this independently" and "a very small few apps that bear the brunt of hostile exposure support independent mechanisms".

It's also worth remembering that both of these specific organizations were instrumental in major, positive security shifts that eventually hit OS's too, including shorter-lived certs, limiting the point of CAs, adoption of TLS 1.3, and likely other things. If anything, they deserve _more_ trust than the OS distributors on this specific front, perhaps also because they don't share the OS distributor's incentive to prioritize stability for paying customers, which can be at odds at times with harsh, prompt security measures.

musicale | parent | next
> Apple fucked this up, but I really don't think the situation is "as bad if not worse" than if MacOS just didn't do this.

https://support.apple.com/en-us/149555

gchamonlive | parent
It makes no sense to imagine this hypothetical scenario and compare it to reality, you have to imagine a similar world with a OS authority, but it only gets updated every 6 months. Which is worse in the worse case? I'd say the one with the lower blast radius.

But this abstract exercise is only to highlight the importance of Apple getting its shit together, because such a scenario exists with Windows and the culture of downloading exes and msis and it's honestly way worse than having a central but responsible authority.