Apple's OS X App Store downloads knackered by expired security cert A forgotten security certificate renewal appears to be behind a series of failed downloads from Apple's App Store. Overnight, users who downloaded Mac apps from the firm's online storefront found they couldn't open the software. The problem appears to be a software certificate – designed to thwart piracy and verify programs …
Google's resources aren't quite as vast as Apple's, but they could also afford to have someone keep an eye on this stuff and have had the same thing happen to them.
The company I'm consulting for at the moment has had this happen to them, so their solution was to choose the expiration date each year so they all expire at the same time. Hopefully that is easier to remember, but if they ever forget it will cause a lot more havoc than one service being offline!
The article said it has happened with others but implied that since Apple has so much money they should be able to afford someone to manage this process. I mentioned Google (who are not poor themselves) since I recall they were recently bit with the same problem:
http://www.pcworld.com/article/2906216/expired-google-certificate-temporarily-disrupts-gmail-service.html
The article said it has happened with others but implied that since Apple has so much money they should be able to afford someone to manage this process.
And as a shareholder you obviously think there's something wrong implying this? Damn right Apple should be doing a better job for its paying customers and developers!
whole certificate concept is flawed.
IMHO when you buy something, it should be yours FOREVER no matter what that item may be,
NOT "disabled" by the whims of an inattentive "administrator" who forgot the renew a certificate!
This is the same for any and all DRM schemes. If they take the server down, do your rights expire?
Not LEGALLY.........if you paid for something, you own it.
" This is why the whole certificate concept is flawed" -- AC
There are some problems with certificates, but expiry isn't really one of them. It's nothing like DRM orphans; certificate expiry is virtually a cryptographic necessity.
There's a lot of dates companies need to remember: tax returns, profit filings, public holidays, audit points, backup schedules, etc. etc. --- it's really not too onerous to track certificate expiry dates.
Not if the cert issuer goes out of business. If I have usable software that I paid for and the manufacturer no longer provides support because they are gone why should I suffer because the software requires that it validate itself online on a now non existent server?
Manufacturers should be required to offer a way to remove the need for validation of said software or media before they can leave the business.
This happened to DIVX video discs when DRM owner Circuit City failed. It happens when DRM controlled electronics are given a forced update and the DRM controlled media/app is no longer compatible. Anyone using permissions based DRM should be forced to call it a lease or a long-term rental rather than a purchase. I believe this is a large driving force behind the race to the bottom in online purchases. The price that I will accept for DRM purchases is based on my expectations of a 3 month lifespan.
If you want to be technical, if you pay for something, you licence the right to use it, but your suggestion is one of those medicine is worse than the disease things.
Breaking a sha1 cert costs about 75K in today's money. In 5 years or so, it will drop to about 5K (assuming no new weakness is found in the meantime that makes it even cheaper; a brave assumption). I find it a good thing that the certificates my bank was using 10 years ago will be rejected.
Also, why are you using the vendors' certificates if you own both client and server parts of the software? Just buy your own and then you can carry on renewing your software certificates long after whatever vendor joins the long list of "remember thems". (Setting aside the wisdom of using software that can never be patched)
Mostly correct, but the banking example you use nicely proves where the fuckup really is.
Having a "hard" expiry date is both unnecessary and daft. A warning window of several months (This one's getting on a bit, feel free to continue, but you might want to drop a line to the site's admins and remind them) before calling it as dead would be far more sensible.
The only difference between a valid cert and an expired one is usually the odd day. Does that affect it's security? No, it doesn't.
Having a "hard" expiry date is both unnecessary and daft. A warning window of several months (This one's getting on a bit, feel free to continue, but you might want to drop a line to the site's admins and remind them) before calling it as dead would be far more sensible.
Sane admins have checks in place that provide that warning window, it's no harder than having a script (say, a Nagios check?) connect to a service periodically and warn if the certificate will expire in less than n days.
If browsers implemented a "warn if cert has < 14 days" then I'd need to change my checks to check for a longer period (say 30 days) if I don't want my users to see nag warnings. So, it wouldn't really change the position someone who's thought it through should be in.
If we go your way, and extend some grace-time afterwards (lets say 2 months). That's 60 days where my compromised cert can still be used. We renew certificates (more importantly, the private key) because the key may have been compromised without our knowledge, so what you're doing is extending the opportunity time for anyone that has laid hands on it.
Certificates expire, so you should note the expiration date, and put a failsafe in place to warn you sufficiently in advance of expiration. Neither of which requires changes to how certificates work.
"That's 60 days where my compromised cert can still be used."
If your certificate had been compromised, you'd revoke it. TeeCee is talking about the date based expiry, which if in date, your compromised certificate could still be used for potentially years unless you revoke it.
"I did say if you did not know it had been compromised" - well if you don't know about it, you're shafted either way, because even with a yearly renewal, you could still be running a compromised cert for a year.
Revocation is the way to go if you know, relying on date based expiry simply isn't secure as a "catch it if I can't" feature for the reason above and you haven't addressed the cause of the breach that compromised the former cert so there is no reason the new certificate won't be compromised either.
The real reason for date based expiry is so CAs can milk us annually.
Cert problems aside, you NEVER, EVER own software, you merely buy the rights to use it. With OSS you are granted rights to use it but simply paying and/or downloading, buying a DVD or USB with said software on does NOT mean you own it, simply the media it comes on. If I wish, as owner of the software, I can revoke that right to use it providing I made that clear in the EULA, which of course we all read from beginning to end before we open/install software!
If you buy a book you have purchased rights to read it as often as you wish but you do not technically own the book. I have to sell you the media ( the paper, card, plastic cover ) 'cos you can't read the book without the medium it comes in, but technically you will never own the book. That's why so many lawyers want to ban second sales on games and books, they see a second sale as a loss as you have no right to make money from someone else's work, you can argue that one as you wish!
That's nothing. One cert expired? Pfft. I remember what was it 2004 perhaps a big CA expired. News was coming for years this cert was going to expire. I was working at a company with nextel as one of our clients. They had outsourced much (all? I don't know) IT to IBM global services. This cert expires and from what was explained to me is virtually every single cert at nextel was hit as a result. All certs went bad globally at the same time. It was pretty amusing. I don't remember how long it took them to recover.
My app store account has been broken since September: apps which require a login (including XCode) start to download and then fail with a poorly translated error message.
The messages in syslog look suspiciously like authentication failures. I've spent over an hour on the phone with Apple's always polite support and have even run a system trace and provided the dump. Silence thus far from the fruity ones but it looks like this evening the problem has been resolved. Coincidence?
"But you'd have thought a company with the vast resources of Apple could assign someone to keep an eye on such things."
They have millions of unpaid resources to do their work for them. The fanbois will notify Apple that something is not working. Why pay for something that you get for free - it helps improve the company bottom line.
But you'd have thought a company with the vast resources of Apple could assign someone to keep an eye on such things.
Umm, I would argue that in a company of Apple's size, (or Google, or Microsoft, or Facebook) then it's likely to always be someone else's job, whereas in a small company it will definitely be assigned to a single individual.
And even then, it's possible to miss one... ask me how I know...
Well, the person who was monitoring it was off sick. Or was tending a sick relative. Or retired and the vacancy hasn't yet been filled. Or the person who took on the role didn't notice this certificate amongst their many other responsibilities. Or management didn't realise the certificate existed -- person X had created it, renewed it, and then wasn't around. Or whoever was responsible screwed up. (We've all been there -- forced to create a certificate which is soon forgotten because it was a 5 second job in yet another 12 hour day.)
You don't get to be a billion dollar company by having someone sitting around doing nothing except monitoring certificates.
Declaration: I have yet to forget to renew a domain or certificate. Yet.
Actually, they've probably got a whole team who do that sort of stuff. I'd imagine in India
It's actually harder to keep track of this stuff if you're massive though because it's probably a pain to get a new cert from central certificate management, so devs do it on the sly and forget to tell anyone.
Then it goes live to millions of people
I switched from PC to Apple in 2007. Was not happy with lack of phone support but once I taught myself Apply language, vs PC I loved all my apple products ! My computers never crashed, they were fast, I never had a problem.
Then Steve died. Apple began falling apart. They introduced Lion, at a too good price to be true. My guy said RESIST, RESIST ! I didn't listen. Then Siri became more cheeky, took time off (just you needed her guidance) with a message, I can't help you now, I'm sorry. No explanation other than she was mourning for Steve. Lion teamed with Micro Soft's iCloud - Apples competitor - continued to reek havoc on my computer ... files disappeared, slow deliver of content, the difficultly of trying to keep my item ON my computer and out of some floating space up in the sky where potentially any hacker can grab and run.
Now trapped in the world of indecision --- wait it out until Apples finds an intelligent CEO / COO with the desire to his best for disillusioned Apple loyals, or to jump ship and go back to buying the slightly less expensive PC's that seem to be working better these days and anti-virus software on a yearly basis that (in past) slowed down performance.
On the very worse of days I long for the time live was simpler: a time one could phone the library to get information, and say real life kitty memes in action, and a time we had friends face to face (with bodies attached) and going to Dairy Queen, playing baseball in the park, meeting 'downtown' to just hang out and be 100% devoted to the others - not mobiles, iPads, or any such distractions. A time when life was much simpler, and far richer. But still....I miss you, Steve !
Since 98'. Was learning apples in grade school when they indoctrinated the children early on. This is NOT apple
Anymore. The should change the name at this point. They have totally screwed the software and no one is interested in that el crapitan. Too bad they are still a better choice then Windows. Someone who knows what the freak they are doing desperately needs to come on the scene and save humanity.
I remember one of my first jobs was an apple network back in 1992. SE10 server and 10 mac plus desktops. I remember upgrading the RAM and needed to knock a resistor to make the upgrade work. They did work quite well as a network.
That being said there was no comparison as the PCs at the time were fairly "voodoo needed" machines (ISA cards including Tseng labs isa VGA).
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
