Hacker News Reader

Comment by JohnTHaller | Hacker News Reader

Please feel free to donate the funds necessary to cover the Apple ID signup for multiple years as well as the potentially necessary Apple hardware to install the SDK on and sign the app (since Apple artificially restricts code signing to only run on their own hardware) as well as any necessary training hours to the team to setup said environment so that they can sign the software they're giving to you for free.

View on HN

It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days. And I would bet that an open source project as big as this gets at least that amount in donations yearly. It's completely irresponsible to not sign releases after something like this happens.

And if they did get $600 in donations in the last year... they should dedicate all of that to the Mac build? Even if they've already spent those funds on hosting and other expenses?

A user of a free product telling the developer of said free product how the developer should be spending the money that said user isn't giving them takes a special kind of entitlement.

A developer should feel a little responsible about the product if it has a large amount of users... It's simply gaining bad reputation for the developer with such news because of saving $100 a year.

If the developers are all students or something and can't pay for that, please let me know if there's a page asking for it and I'll pay or any of the other 1000 users who can.

Hold on… your premise doesn't make sense. Apple's SDK only officially runs on Mac - but that applies to the entire build process, not just codesigning. Anyone who is already producing a Mac build either has access to a Mac build host, which they can also use to sign, or is using third party tools to cross-compile from another OS.

In the latter case, there is also a third party tool capable of signing binaries:

https://github.com/saucelabs/isign

You do need to pay the $99/year for the certificate, but it shouldn't be necessary to buy hardware just to sign things.

It's worth noting that you need access to a Mac you can trust to setup your Apple developer credentials on as well as iSign and then export your credentials and certificate from each time you get a new certificate. It's likely you won't be able to do this in the Apple store. While you or I may have a colleague or trusted friend we could do this with, many developers will not.

It does say that in the readme, but I don't think it's actually necessary: you can get certificates and provisioning profiles through the web portal without going through Xcode. (For certificates, it has you upload a standard CSR file.) Though developers may not know that…

Admittedly, if you don't have a Mac build machine, (a) you can't test your builds, and (b) you can't use the official SDK (including, e.g., system header files) without violating the terms of service. Not that many people care about that, but if you don't mind ToS violations you may as well just install pirated macOS in a VM (which is easy enough in practice). Perhaps Apple deserves blame for not having a legal way to run a macOS VM on non-Apple hardware; certainly it makes life harder for open-source developers that want to play by the rules. Still, these obstacles have nothing to do with signing.

A user of a free product telling the developer of said free product how the developer should be spending the money that said user isn't giving them takes a special kind of entitlement.

There is a very simple solution. Get a dev program membership. Sign and sandbox the application and make it available in the Mac App store for $1.99. People who want a signed, sandboxed Handbrake pay the equivalent of a cup of coffee. People who want to play Russian roulette can download Handbrake for free on the web page.

Given that Handbrake is extremely popular, that small fee will probably cover the $99 per year plus a Mac Pro (or two) within no time.

>It's $100 for the signing and $500 for a Mac Mini. Any professional software developer would make that kind of money in a few days

Sorry but you are living in a bubble. There are thousands of software professionals who don't make that kind of money in India, South America and many other places.

If the author of Handbrake is one of them, that can hardly be construed as the users' fault.

Run some Google ads or something.

Explain that to me slowly: if you're enjoying the work of someone from a place where the economy is vastly different and worse than where you live, that person should feel bad about your loss or inconvenience?

Please use very small words. I am struggling.

Handbrake is a very popular package. It's probably downloaded about a million times a year. It would be very easy for the author to pay for a code-signing certificate with either donations from users or unobtrusive, inoffensive amounts of advertising.

Best practices call for releases of executable code to be signed for the reasons outlined here.

Small enough?

Almost, but I got stuck on the part where you didn't offer to buy the certificate.

What about the part about millions of downloads being enough to pay for it?

Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software.

Come on, if every developer that uses any kind of Free Software decided to donate every hour the dollar amount of one HOUR of their work for the projects that THEY need, no one would be in this mess.

Or you know, don't be a entitled jerk of an user who can't be bothered to support Free (as in Speech, NOT as in beer) Software.

(Shrug) I've authored a large amount of software that's free as in both. I sign my releases for my users' protection, and also to avoid looking like a careless dilettante. I expect others who are serious about their craft to do the same.

If that makes me an "entitled jerk," well... meh. There's no way to respond to an accusation like that except to own it.

While its great that you have a spare $100 a year and the money to invest in Apple hardware to digitally sign Mac builds, not every project will have those resources. Projects that don't have the resources will often publish hashes so that users will be able to check to ensure their download is legitimate before using it. Handbrake does this: https://handbrake.fr/checksums.php

Handbrake does this: https://handbrake.fr/checksums.php

And how's that been working out for them (and their users)?

> And how's that been working out for them (and their users)?

It likely worked out fine for anyone who checked the SHA256 before installing it. Which, unfortunately, is likely a small minority of users.

Checksums != signatures

For free, the author could simply GPG sign all releases for all platforms and suggest users verify them. Then, the decision to run untrusted code is the user's decision and bypasses platform monetization.

Then, if suffient and continual contributions of money and expertise permit, official codesigning per platform could be added as another layer (defense-in-depth).

Wow. Waste of bits (your comment). Please take your political agenda some where else. This is the 3rd time this author has been compromised. For $99 it seems a bit negligence on his part. Donations are not excepted so...

"The HandBrake and HandBrake Documentation projects are not accepting monetary donations. Please instead consider donating to the VideoLAN non-profit organization and the Blender Foundation."

It's cheaper than that. I've let my Apple developer subscription lapse but I can still sign packages until my certificate expires. You can probably also get a reasonable second-hand Mac mini for $200.

So you are looking at an up-front cost of $300 then around $25 per year.

Travis CI is free for open source projects, perhaps they could better invest their time into working with that then rebuilding.

I'm assuming the price for hosting the mirrors isn't free, and probably more than $100/year. If they moved to github releases they could recoup some money.

Then they would be reliant on a commercial company's closed source infrastructure for hosting. This has its own risks.

The risks are relatively insignificant.

Please feel free to donate the funds necessary to cover the Apple ID signup for multiple years

Certs are free for apps published outside of the MAS: https://www.reddit.com/r/apple/comments/69n9ii/recent_versio... https://www.reddit.com/r/apple/comments/69n9ii/recent_versio...

as well as the potentially necessary Apple hardware

It's a pretty safe bet that an OS X/macOS developer already has a Mac.

You can sign builds on Travis CI [1] (free for open source), so no apple HW needed....

[1]: https://medium.com/juan-cruz-viotti/how-to-code-sign-os-x-el...

You still need access to Apple hardware. From my other comment on a similar tool: "It's worth noting that you need access to a Mac you can trust to setup your Apple developer credentials on as well as iSign and then export your credentials and certificate from each time you get a new certificate. It's likely you won't be able to do this in the Apple store. While you or I may have a colleague or trusted friend we could do this with, many developers will not."

The comment you linked to was "[deleted]" and countered by the followups.

Thanks for correcting me. There were actually two comments by two different users (the links above appear identical since they have been shortened, but the full URLs are unique). I should have looked more deeply into the matter before posting the assertion and links - my apologies.

No worries. I think you and I both wish it were true as it would make it easier for more open source software to be signed.

While users could help financially, a project should not delegate the responsibility of security down to users until they explicitly donate for that especially for a project of this amount of user base.

OK. I'll contribute. Where is the developer talking donations for this specific purpose?

Reply on news.ycombinator.com