Back then I had no permission to use a computer ("they make you stupid" was my parents argument) and certainly no credit card to pay anybody to do development - and even then, as a minor I would probably never have gotten that certificate.
The computer isn't free either. And you can always build and distribute without the ID or the certificate. This is just for distribution through the App Store or to users that have it set to only allow signed apps.
Does this stop malware? Does this stop fraudulent call centers? Does this stop malicious people from telling people to turn it off and then still installing the malware? No.
"No" to the last question, maybe. On the other hand, it stops tons of malware. Signed binaries is considered one of the most successful anti-malware strategies by security experts. Are you saying otherwise?
Does it stop people like me from ever getting to their career of their dreams? Likely.
Well, if you are that easily discouraged, then maybe that career wasn't really for you, anyway.
You present an edge case ("I need to build and distribute my software to OS X users AND I want those users to not only allow signed apps BECAUSE I can't fork $100 dollars for a developer certificate").
If that kind of thing discourages you from "getting to the career of your dreams" what to say about the hundreds of thousands of dollars and years of toil needed to become a doctor, a lawyer, not to mention the hard learning needed to become a professional programmer.
> On the other hand, it stops tons of malware. Signed binaries is considered one of the most successful anti-malware strategies by security experts. Are you saying otherwise?
As you've decided to pick anonymous security experts, I thought I'd chip in. I don't know if I'd call myself an expert but I've over a decade in industry breaking systems, fixing software and booting out bad guys, I'm speaking at BlackHat EU next month and I co-founded a security conference so I guess that means I'm not a complete security chump. I can categorically tell you that signed binaries are only part of a strategy, and not necessarily the best one at that. If your goal is to increase the cost of exploitation then signing can help, but so can a decent access control model (into which signing becomes a part thereof).
To put it another way, it's possible to defeat applocker (windows binary signing), iOS code signing on iOS 5.0.1, the XBox and Xbox 360's code signing restrictions, the PS3's code signing restrictions, and more recently, an analysis of RSA keys showed that between 2 and 4 out of every thousand keys are insecure due to weak randomness[1].
The bottom line is that code signing, like placebos only work if you believe them to unless they're backed up by something more solid to augment them and they form a stronger coherent strategy.
At this stage all code signing settings will do is encourage developers to get Apple IDs and for customers to use the App store as they know "it's safe". Even though we know it doesn't mean anything[2] to the end user in reality. The real thing that Apple will do is further on the line when they decide to make it so that you can only run signed apps (and this is at least the direction apple are taking) through their app store.
Your edge case point applies to countless open source developers, including those that worked on the original FreeBSD code that went into Darwin. Apple are of course, under the licences they've inheritied allowed to implement code signing, but please don't think this is an anti-malware measure, it isn't. It's about control of distribution. Anyone that wants to bypass code signing on an Apple product will find a way to do it.
"code signing […] only work if […] they're backed up by something more solid to augment them and they form a stronger coherent strategy."
You mean things like sandboxing and blacklisting? Or do you think this is not (an attempt at) a coherent strategy?
"At this stage all code signing settings will do is encourage developers to get Apple IDs and for customers to use the App store"
It also (even if ever so slightly) decreases the attack surface. It is harder to infect executables if the OS checks the hash of the code every time it is run. Finally, it gives Apple a handle for disabling malware, once it has detected it. That will not prevent malware from infecting systems, but it can make it less likely that machines will keep getting infected for years after the time.
The computer isn't free either. And you can always build and distribute without the ID or the certificate. This is just for distribution through the App Store or to users that have it set to only allow signed apps.
The latter is the default. So for other people to use this application I wrote as a minor, my users would have to change the setting.
Well, if you are that easily discouraged, then maybe that career wasn't really for you, anyway.
This would not have stopped me, but imagine what kind of an ego-boost it is for a 15 years old sufferer of heavy bullying due to overall geekyness to see his home-grown application not just be used by other people but actually getting mentioned in paper publications.
Nowadays I couldn't even get /permission/ to try because these various developer programs require you to be an adult due to various organizational issues.
Honestly, without that ego boost when it happened, I don't know where I would stand today, if at all.
But this is my story. I have a feeling that I'm losing objectivity here due to heavy emotional involvement. I'll be quiet in this topic from now on and just turn that switch off for myself, hoping that there will be a switch to turn off in the future.
The latter is the default. So for other people to use this application I wrote as a minor, my users would have to change the setting.
Yeah, but should users configure their systems to the distribution convenience of some developers?
Or should Apple keep signed apps forever away from OS X for the same reason?
Or should they introduce them, but make unsafe apps the default, and thus render them useless for non security minded people?
All of those options seem a little strange to me.
Nowadays I couldn't even get /permission/ to try because these various developer programs require you to be an adult due to various organizational issues.
Yes, but consider some other things:
a) nowadays computers are a dime a dozen and more kids have access to them than ever.
b) nowadays there are tons of compilers, programming environments, most of them given away for free and/or open sourced.
c) nowadays a kid can make a web app and reach millions of people worldwide. There are tons of ways to put it up even for free.
d) nowadays there are even kids making iPhone/iPad/Android apps, and some have reached hundreds of thousands of users.
e) the sound/graphics/processing capabilities of modern machines were unheard of in those times.
f) High Level languages like Python/Ruby/Javascript trump anything available at the old times for kids (mostly stuff like Basic, Logo, etc). Especially in the libraries department.
The computer isn't free either. And you can always build and distribute without the ID or the certificate. This is just for distribution through the App Store or to users that have it set to only allow signed apps.
Does this stop malware? Does this stop fraudulent call centers? Does this stop malicious people from telling people to turn it off and then still installing the malware? No.
"No" to the last question, maybe. On the other hand, it stops tons of malware. Signed binaries is considered one of the most successful anti-malware strategies by security experts. Are you saying otherwise?
Does it stop people like me from ever getting to their career of their dreams? Likely.
Well, if you are that easily discouraged, then maybe that career wasn't really for you, anyway.
You present an edge case ("I need to build and distribute my software to OS X users AND I want those users to not only allow signed apps BECAUSE I can't fork $100 dollars for a developer certificate").
If that kind of thing discourages you from "getting to the career of your dreams" what to say about the hundreds of thousands of dollars and years of toil needed to become a doctor, a lawyer, not to mention the hard learning needed to become a professional programmer.