<story><title>Mac Store Apps Stopped Working Due to Expired Security Certificate</title><url>http://techcrunch.com/2015/11/12/all-mac-store-apps-stopped-working-due-to-expired-security-certificate/#.y37x7x:xhzD</url></story><parent_chain><item><author>cortesoft</author><text>But if a program keeps running with an invalid security certificate, what is the point of having the certificate at all? If the practice is &amp;#x27;let the program with an invalid cert run silently for 2 days&amp;#x27;, then you aren&amp;#x27;t gaining any security at all. Malware could do everything it needs in 48 hours.</text></item><item><author>makecheck</author><text>I think &amp;quot;grace periods&amp;quot; should be a lot more common in software.  Not every issue is the user&amp;#x27;s problem, and not every problem requires a drastic response.&lt;p&gt;For instance, they could have:&lt;p&gt;- Quietly noted the issue in a file somewhere, waited 24 hours, and checked again.&lt;p&gt;- If the problem was still present after 24 hours, they could have made the software discreetly submit a problem report to Apple (but still launch and work correctly).&lt;p&gt;- After 48 hours, they could issue a background notification to the user indicating that a problem has been detected in the program and to “please check for updates on the App Store”; but again, continue to work correctly.&lt;p&gt;Or in other words, there were only about a half dozen more reasonable things they could have done that didn&amp;#x27;t involve an Amazonian break-things-immediately type of response.</text></item></parent_chain><comment><author>mikeash</author><text>This particular bit of verification has nothing whatsoever to do with security. It&amp;#x27;s an error in purchase verification. If the practice is to let the program run with an invalid purchase receipt for two days, then you&amp;#x27;re just giving pirates a free two-day trial. Some people might see that as a problem, but I personally value the experience of paying users over inconveniencing pirates.</text></comment>
<story><title>Mac Store Apps Stopped Working Due to Expired Security Certificate</title><url>http://techcrunch.com/2015/11/12/all-mac-store-apps-stopped-working-due-to-expired-security-certificate/#.y37x7x:xhzD</url></story><parent_chain><item><author>cortesoft</author><text>But if a program keeps running with an invalid security certificate, what is the point of having the certificate at all? If the practice is &amp;#x27;let the program with an invalid cert run silently for 2 days&amp;#x27;, then you aren&amp;#x27;t gaining any security at all. Malware could do everything it needs in 48 hours.</text></item><item><author>makecheck</author><text>I think &amp;quot;grace periods&amp;quot; should be a lot more common in software.  Not every issue is the user&amp;#x27;s problem, and not every problem requires a drastic response.&lt;p&gt;For instance, they could have:&lt;p&gt;- Quietly noted the issue in a file somewhere, waited 24 hours, and checked again.&lt;p&gt;- If the problem was still present after 24 hours, they could have made the software discreetly submit a problem report to Apple (but still launch and work correctly).&lt;p&gt;- After 48 hours, they could issue a background notification to the user indicating that a problem has been detected in the program and to “please check for updates on the App Store”; but again, continue to work correctly.&lt;p&gt;Or in other words, there were only about a half dozen more reasonable things they could have done that didn&amp;#x27;t involve an Amazonian break-things-immediately type of response.</text></item></parent_chain><comment><author>wtallis</author><text>There&amp;#x27;s minimal security risk in allowing a formerly-validated piece of software to remain usable so long as it is not modified by any updates that cannot be verified by a current certificate.&lt;p&gt;Being this strict at the cost of usability isn&amp;#x27;t about security, it&amp;#x27;s about DRM and making sure you don&amp;#x27;t get to keep using your software after the subscription has expired.</text></comment>