>>25625
The original developer doesnt need his key to be stolen.
Any random dude who gives apple money can sign with his own signature and publish his copy.
Lets say three people publish the same software with their own keys, how do you know who the original upstream approved one is?
You dont, unless you VERIFY IT YOURSELF by asking the developer. The Apple signature check does fucking nothing to help you here.

Which gets us back to the original question:
Did you ever, in your whole life, verify a signature of an app you installed?

>>25624
Yes I do it all the time, sometimes manually and most often automatically since checking whether they keys match before installing and updating is standard practice in almost all terminal utilities like brew
>Apple isn't visiting the upstream repo to ask the developers if they are ok with this guy publishing their software
this isn't the own you think it is. you might find the recent publishing of notepad++ for macos instructive

>this fucking argument
nuke india

>>25576
do you think you can just own things and be happy ?

>>25627
>most often automatically
no such thing exists, no automatic signature check goes to the upstream repository to check who the original developer is

They operate on a chain of trust, and you gave it the trust the first time you installed it.
Just because the update is verified to come from the same source as the original install, doesn't mean that the original install didnt come from a scammer.

>>25630
Yes and if somebody replaced the original dev with a clone you'd never know so I guess the whole process is pointless. You sure got me here
>no automatic signature check goes to the upstream repository to check who the original developer is
which is why AUR is a shitpile where you're essentially rawdogging the internet
most other repos, like homebrew, don't work like that. I can't upload "whatsapp 2 (totally legit)" whenever I want

>>25618
>>25624
>Did you ever, in your whole life, verify a signature?
The OS does it for you. Your app store (software repo / package manager) is in charge of that. Any normal OS blocks the installation of an app or at least warns you in case of a signature mismatch compared to your already installed version.

>>25621
>>25626
>how do you know that the unique signature you see belongs to the person you want?
Your question is irrelevant. It's not the person that matters, it's the key that matters. You're verifying if a key is trusted. The person behind it can be anyone. You can have multiple people re-distributing the same app with different signatures. What matters is that there's a database of keys which are verified to not distribute malicious software, and keys that are known for distributing malicious software.
Signatures are not meant to be a bulletproof solution to fight against malware, since any dev can go rogue or get their private keys stolen if they're incompetent.

But to answer your question: Publishers verify their signatures in the app stores they publish their software to. Software distributed on it's official github/gitlab is signed by the devs. Keys are attached to developers' Apple, Google, Microsoft, Github, Gitlab, etc. accounts. You literally cannot publish your app onto an app store without passing signature verification.

You're speaking in circles when you say
>how do you know who the original upstream approved one is?
>VERIFY IT YOURSELF by asking the developer
How would you even know who to ask in the first place?

>how do you know
>You dont
Again, you have no idea how anything works. 3 people publishing an identical application would result in 3 different apps being on the app store. You're literally shown which user uploaded it and what the registered domain of the app is. That's more than enough to verify who the original owner is, unless you're sideloading in which case you need to do key verification or a hash check.

>>25631
you are just being dishonest now

maybe learn gpg, especially why you have to give someone trust and how to do that

>>25630
>no such thing exists, no automatic signature check goes to the upstream repository to check who the original developer is
Then it sounds like your repository is dogshit and shouldn't be used.

>>25634
I run arch btw

>>25632
>It's not the person that matters, it's the key that matters.
when did you verify that the key belongs to the person that developed the software?

>>25636
Read >>25632

>>25636
IfnApple verified that he paid the developer fee, he must be the original developer. Because nobody who pays Apple would ever lie.

>>25636
Never, because it's irrelevant if the official developer is the distributor or not as long as the software is not maliciously tampered with.

Software distribution is all about trust no matter how you look at it. Signatures and certificates just help you know if your software is always coming from the same source that you already trust.

>>25610
>dnf
Don't compare Apples bullshit with a Linux repository! They work fundamentally different.
The signing keys in dnf verify that it's coming from the official repository, even if the distributing server is some random university that donates resources. The Fedora repository only consists of vetted package maintainers who all had to go through some elaborate process where other maintainers had to vow for them. There are 300 of those.

Meanwhile the signature check that Apple does only verifies that the key is from someone who paid the Apple fee, which is over 30 million people, and that it went through an automatic virus scan (lol).
It is YOUR responsibility to check if this app comes from upstream or has upstream approval. Nobody else can do that for you. YOU have to check that.
Therefor the question is justified: Did you ever do that?
If you don't, the signature might as well not exist.

kek librewolf screeching about muh apple signature being useless hasn't bothered to get into the official dnf either, you need to add his own third party repo

>>25641
Which is why you should just use Flatpak on Linux. Librewolf is verified there.

>>25639
>because it's irrelevant if the official developer is the distributor or not as long as the software is not maliciously tampered with
...which is trust that you can give to a small circle of vetted package maintainers of a linux repository, but not trust that you can give to some random ass person who paid the Apple fee.

At that point you are just installing random software from a random person and the signing did absolutely nothing to make you secure.

>>25626
it obviously depends on what Apple chooses their verification process to entail. they could just use the same upstream public keys / signatures as everyone else, but presumably there's more to it, possibly real identities being tied to it, judging from the resistance that this initiative has been met with.

>>25580
>>25603
Not to this extent. Microsoft has a "be careful bro" warning or might false flag it as a virus if it does something out of the ordinary. Android just has an "I know what I'm doing" checkbox buried in the system. On Linux it's integrated in your package manager so it doesn't update if the domain gets hijacked.

>>25643
>which is trust that you can give to a small circle of vetted package maintainers of a linux repository
who says I trust them either?

>At that point you are just installing random software from a random person
that's exactly how installing any software works

>the signing did absolutely nothing to make you secure.
it does prevent me from accidentally installing something from a different source

>>25645
>Android just has an "I know what I'm doing" checkbox buried in the system.
yes and no. as previously stated, android blocks you from installing the same app with a different signature on top of an existing app.

>nooo why would the wholesome multinational company betray me like this
your favourite companies are NOT immune

>>25646
>who says I trust them either?
Then you don't install their distribution and go with a different one of those thousands out there.
If you don't trust Microsoft, you shouldn't install Windows.
If you don't trust Apple, you shouldn't use MacOs.
It's the most basic level of trust you can't get around.
>actually, signing is pointless anyway
ok...

>>25644
>depends on what Apple chooses their verification process to entail
what it entails already got mentioned multiple times:
>paid money and went through an automated malware scan
This is what your signature verification guarantees you, not more and not less.

>>25648
>Then you don't install their distribution
why not? I need an OS
>actually, signing is pointless anyway
never said this and this is not the case at all, signing is absolutely important and even you admitted it when it comes to linux repositories

Using a Mac is owning nothing and being happy, if you want to use real browsers, use a real OS.

>>25648
You can run windows fine if you dont trust ms just dont do things on it that can compromise you on them like log into an online account on the OS or use external network hardware to outright deny some outgoing datastreams

>the people endlessly crying about applel are clueless about technology
how unexpected

>>25650
>why not? I need an OS
You will have to chose a distributor to trust.
The thought that you could run Windows without trusting Microsoft, Mac without trusting Apple or Android without trusting Google is ridiculous and dumb. And it's only spread by corporate drones and goycattle who cope about their serfdom.
You don't trust Fedora maintainers? Then don't use Fedora.
>i didn't say that
if you reduce the purpose of a signature to "the one who signed the update is the same who signed the initall software i installed", the signature might as well not exist. You can achieve the same thing without signing. You could install an unsigned exe from a website that uses SSL and ACME-CAA, with an updater using the same domain, and that's it.

>>25651
>use a real OS.
Like what? red star os?

>>25652
Some sleeping ransomware or kill switch could work without internet connection
>MS Word nuking your system if it detects that you wrote "nigger" in a docx
you have to trust them

>>25654
>security, verifiability and validation is irrelevant because you can achieve the same thing without it
great argument

>>25657
>verifiability and validation
Is there even one single software that you contacted the developer for to compare signing keys?

>>25658
of course

>>25576
Because ublock and ads.
Manifest3 is a cardinal steps of the antiworld to come.

>>25576
>it does not pass the macOS Gatekeeper check
lol

>>25576
>they have no fucking right to prevent me from using libre software
They have every right. It is their system. You don't like it? Leave.

>>25612
>zased