Windows code signing is performed using a certificate available from the usual certificate authorities (Verisign, Thawte, etc, etc) that you pay to verify your identity and issue you a signing certificate.

Apple is the only one that enables OSX signing and it's done in conjunction with your Apple ID that you pay Apple a yearly fee to enable developer abilities on.

The fact that this became a back and forth of people arguing which is worst just highlights the fact that this sort of low level infrastructure needs to be free and open.

Yes we indeed need freedom to install kernel boot kits wherever we want.

I think most people would just like to be able to install software on devices they have bought. Proper respect for property laws, sale laws and so on.

Does it? But then who polices it?

Id be curious to know of an instance where apple abuses their power and denied a competitor the ability to sign a binary.

Personally I'd much rather have someone like apple be able to have some kind of audit where by malicious extensions can be revoked. There might be some super clever way that you could do this with the block chain or the like, but ultimately I don't know how this doesn't come down to a person somewhere deciding.

As it stands now most package managers already require signatures before installing applications. We already put trust in the people who maintain the repositories- and whose keys we've decided to use for verifying code. My issue isn't so much with who polices it, my concern is how easy can I override it.

I would have absolutely no problem with Ubuntu shipping with this exact same feature, assuming that I can also add in other sources of trust and self sign extensions I want to place in.

My point is that the problem isn't whether someone can make these decisions or not. It's good to have people make them, and that extra level of protection can mean a lot. None of that is a problem- the real issue is Apple attempting to enforce exclusive trust.

"Id be curious to know of an instance where apple abuses their power and denied a competitor the ability to sign a binary."

This will happen the instant it becomes opportune, Apple being a business, having shareholders and all that. No precedent is needed (they surely have used their power to deny stuff that is not "malicious" in the App Store before).

> This will happen the instant it becomes opportune

You'll see. Personally, I'm happy to be at least notified when something random attempts to install an unsigned kernel extension.

Windows SSL cert costs 267$ a year: https://www.digicert.com/friends/sysdev/ (click start)

Apple certificate costs 99$. Indeed, you won't be able to sign anything else, but it is still more that 2 times cheaper.

That one random CA you quoted costs $267 a year.

As far as I can see the requirement is that the CA is cross-signed by Microsoft, and that's quite a large list [0].

I'm only familiar with one of them (StartCom), and that one charges $59 a year for unlimited domain certificates and 1 code signing certificate.

[0]: https://msdn.microsoft.com/en-us/library/windows/hardware/dn...

>Also, OSX doesn't require the kexts to be signed by Apple themselves - the requirement is that the kext is signed by a certificate that is blessed by Apple's CA. There are plenty of third party kexts out there.

I'm curious who has Apple blessed to do so, and what those kexts are?

Anybody who pays the $99/year to be an OS X developer and hasn't subsequently had their cert revoked for distributing malware.

Well, that's quite accessible. Good to know, thanks.

What a depressing attitude

Maybe go see a doctor about that. Just because I'm asking a question and then not committing righteous suicide because of how great my first world problems are, doesn't mean I actually expressed an opinion about driver signing in general, one way or another.