Perry The Cynic: Thanks so much for stopping by. I really appreciate your efforts to keep the lines of communication open.

I appreciate that this infrastructure is targeted at giving the user more power over his own device, and if that's where it stays then I'm quite happy with it. However, the sudden appearance of the iPhone SDK, using code signing to completely lock down the device, makes me pessimistic. Maybe it is fundamentally different, maybe Apple would never dream of doing this on a "real" Mac, but it makes me paranoid.

I find it a little odd that you describe an environment which only runs signed code as "nirvana", yet at the same time admit that the simple possession of a signature is meaningless. If you accept anything that's signed, then an attacker can merely re-sign the app after modifying it. You gain no protection from alteration, only some small form of accountability over it.

I'm also somewhat doubtful about how well this will protect from viruses and worms. All the worms will be signed in such an environment, and will appear as legitimate as they always have. A user may have to take some action to approve them, but he intends to take that action anyway since he will have to do it for any new application. It may allow an administrator to save his underlings from themselves, but that case is significantly more rare than a user who owns his own machine.

My understanding of how code signing is implemented is that it won't detect an application whose security has been compromised by means of a buffer overflow or other such exploit. It may limit the damage which can be done by such an application once it has been compromised, but then we come back to having the exploit code re-sign any applications it modifies. Certainly you'd be able to exploit Safari's image handling to upload all of the user's credit card numbers to a server in Uzbekistan without needing to hit any other apps.

If Apple can resist the temptation to turn this into a tool of evil then I think it can be a good thing, although of course it is far from a panacea. But I'm afraid that the iPhone has demonstrated that Apple may not be very temptation-resistant.

One last note: I think you meant to say, "Apple is legally required to make a totally half-assed attempt at keeping you from hacking DVD Player.app".