> Tangentially, I'm a little miffed at spending $100 to get certificates to do Developer ID, but in the Grand Scheme of Business, it's just not that much money.
My understanding is that Gatekeeper signing is free.
Depends on how you define "free." Apple says "no additional charge over your Mac Dev membership. It's included with the Mac Developer Program." I spent two entire days watching WWDC videos and digging around on developer.apple.com trying to find out how to get certificates without paying Apple the $99 for Mac Dev.
The Apple employees that I am connected to were also surprised to find out that it wasn't free outside the Mac Dev program. A former Appler helping me dig around also noted that Apple never said it'd be "free."
If you can find somewhere Apple said it would be free, I'd love to dig deeper.
I don't know about you, but I tend to multitask with things like research. Did I spend two solid, uninterrupted days without touching any other projects or not performing any other work-related activities? Of course not. This kind of thing is right up there with "Why is the sky blue?" and researching until you're satisfied with the answer. I spent the money, I'll see a return on the 'investment' before the week's out. But I'd still like to know more about what Apple said, when they said it, and how they've changed it since then.
Also note this in my comment above: "...in the Grand Scheme of Business, it's just not that much money."
Why not? They can get them for $99 and the rewards will likely net them thousands of dollars before Apple catches on and revokes their certificates. If you want cost to be an obstacle to malware authors, it needs to be more than a measly $99.
This is simply a mechanism for Apple to stay ahead of any worm-like activity and they decided to attach a barrier to entry ($99) and recoup a pittance while they're at it.
It also gets Apple more information on the developer, should the company ever want to track them down. A payment history leaves a wider and longer paper trail.
I'd also assume that Apple blacklists any certificate if the developer used some sort of fraudulent payment. I'd hope so, in fact.
My understanding is that Gatekeeper signing is free.