As it stands now most package managers already require signatures before installing applications. We already put trust in the people who maintain the repositories- and whose keys we've decided to use for verifying code. My issue isn't so much with who polices it, my concern is how easy can I override it.
I would have absolutely no problem with Ubuntu shipping with this exact same feature, assuming that I can also add in other sources of trust and self sign extensions I want to place in.
My point is that the problem isn't whether someone can make these decisions or not. It's good to have people make them, and that extra level of protection can mean a lot. None of that is a problem- the real issue is Apple attempting to enforce exclusive trust.
Re:GNU Hurd 0.6 released
by UweSchmidt on Thursday April 16, 2015 @02:03AM
(#9386121)
"Id be curious to know of an instance where apple abuses their power and denied a competitor the ability to sign a binary."
This will happen the instant it becomes opportune, Apple being a business, having shareholders and all that. No precedent is needed (they surely have used their power to deny stuff that is not "malicious" in the App Store before).
Id be curious to know of an instance where apple abuses their power and denied a competitor the ability to sign a binary.
Personally I'd much rather have someone like apple be able to have some kind of audit where by malicious extensions can be revoked. There might be some super clever way that you could do this with the block chain or the like, but ultimately I don't know how this doesn't come down to a person somewhere deciding.