←back to thread

Catalina is checking notarization of unsigned executables

(lapcatsoftware.com)
361 points robenkleene | 2 comments | 23 May 20 09:42 UTC | HN request time: 0.498s | source
Show context
usmannk ◴[23 May 20 16:27 UTC] No.23284235[source]▶
There is so much confusion here. The OP and most others are missing one of the biggest points: Look at the packet trace. There is _no data_, not even a hash, being sent. It's a TLS negotiation and then the connection ends. I have to suspect it's a bug...
replies(6): >>23284309 #>>23284481 #>>23284891 #>>23285137 #>>23285544 #>>23287368 #
1. cryptonector ◴[23 May 20 22:59 UTC] No.23287368[source]▶
"no data", just a TLS handshake. Of course information can flow! You could put a hash of the executable in a ClientHello extension, and if the server says "i don't know it to be malware" it can finalize the TLS connection normally.
replies(1): >>23288635 #
2. userbinator ◴[24 May 20 02:37 UTC] No.23288635[source]▶
I have a feeling that there is already a system out there which does something like that.