Hacker News Reader

This is literally also how cert signing works for tls. Unsurprisingly miss-issued certs have been far from common.

This model can work. It's just that microsoft is being sloppy.

Mis-issued certs are common enough that Google et al had to force Symantec out of the cert issuing business. It's a model that only works with a monopolistic cartel gatekeeping the ability to issue certs (which is basically Apple's role in this scenario).

There's been issues with code signing but you can't say it's been pointless. It's a significant hoop to jump for malware writers and out of reach for basic script kiddies.

> Unsurprisingly signed malware has been far from uncommon

Malware is very common on the Play store as well, signed software by one gatekeeper does not guarantee anything.