Code Signing
Cryptographically attesting who produced a binary, and the operating-system checks built on it.
Code signing attaches a cryptographic signature to an executable, attesting to its origin and proving it has not been modified since. Operating systems use signatures to decide whether to run something and what capabilities to grant it.
On macOS the layered system is worth understanding as a practical matter. An application can be unsigned, ad-hoc signed (a signature with no identity behind it), signed with a paid developer identity, or additionally notarized — submitted to Apple for automated scanning and stapled with a ticket. Files downloaded through a browser carry a quarantine attribute, and the system's Gatekeeper check refuses to launch quarantined applications that are not notarized.
The consequence for anyone sharing a small tool informally is concrete: an ad-hoc signed application, sent to another machine, presents a dialog claiming the app is damaged. It is not — it is unnotarized and quarantined. The reliable fix is removing the quarantine attribute; the folklore workaround of opening from the context menu no longer applies to ad-hoc signed applications on recent versions.
Testing this requires a machine other than the one that built it, since a local build has no quarantine attribute and a development-path fallback can mask the failure entirely. See Ground Truth.
See also12
Letterlocking
Folding, slitting and sealing a letter so the sheet becomes its own tamper-evident envelope.
Meaning & Society8 connections
Daemon
A long-running background process managed by the operating system's service supervisor.
Systems & Tooling19 connections
Supply Chain Security
Protecting against compromise arriving through the code and tooling a project depends on.
Version Control & Delivery24 connections
Least Privilege
Granting only the permissions actually required, so a compromise has a small ceiling.
Systems & Tooling38 connections
Secret Management
Storing, distributing, and rotating credentials without embedding them in code or history.
Systems & Tooling33 connections
Prompt Injection
Untrusted content that reaches a model's context and is treated as instruction.
Agents & Language Models18 connections
Observability
How much of a system's internal state can be inferred from what it emits.
Method32 connections
Silent Failure
A failure that produces no signal, so the absence of an error reads as success.
Method73 connections
Cron
Time-based scheduling of recurring jobs, and the reasons scheduled jobs quietly stop working.
Systems & Tooling19 connections
Dual Boot
Installing two or more operating systems on one computer and choosing between them at startup, a common way to keep Windows for some tasks and Linux for others, with recurring friction over bootloaders, clocks and shared disks.
Systems & Tooling9 connections
Commit Signing
Cryptographically signing Git commits so a commit's author can be verified rather than merely claimed, the key types used, and what a green verified badge does and does not prove.
Version Control & Delivery10 connections
GNU Privacy Guard
A free implementation of the OpenPGP standard for encrypting and signing files, email, and software releases, descended from Phil Zimmermann's PGP and known both for its importance to software distribution and for being hard to use.
Systems & Tooling7 connections
Linked from21
- Boot ProcessSystems & Tooling
The chain of handoffs from power button to login screen, firmware to bootloader to kernel to init, and where each link can break or be verified.
- Caller ID AuthenticationNetworks & Distribution
Cryptographic attestation of an originating telephone number, and why spoofed calls survive it.
- Certificate AuthorityNetworks & Distribution
An organization trusted to vouch that a public key belongs to a domain or entity, the root of trust behind every HTTPS padlock.
- Commit SigningVersion Control & Delivery
Cryptographically signing Git commits so a commit's author can be verified rather than merely claimed, the key types used, and what a green verified badge does and does not prove.
- Confidence TrickMeaning & Society
Fraud that obtains trust first, so the victim hands over the money themselves.
- DaemonSystems & Tooling
A long-running background process managed by the operating system's service supervisor.
- Dual BootSystems & Tooling
Installing two or more operating systems on one computer and choosing between them at startup, a common way to keep Windows for some tasks and Linux for others, with recurring friction over bootloaders, clocks and shared disks.
- EmulationPlay & Games
Software reimplementation of console hardware, and the fault line between preserving a game and possessing it legally.
- eSIMNetworks & Distribution
A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.
- FirmwareSystems & Tooling
The software built into hardware itself, running every keyboard, drive, and charger below the operating system, hard to inspect, risky to update, and a favorite hiding place for persistent malware.
- Game PreservationPlay & Games
The effort to keep games playable against delisting, license expiry, server shutdown and hardware rot.
- GNU Privacy GuardSystems & Tooling
A free implementation of the OpenPGP standard for encrypting and signing files, email, and software releases, descended from Phil Zimmermann's PGP and known both for its importance to software distribution and for being hard to use.
- Kernel PanicSystems & Tooling
The operating system kernel deliberately halting when it detects an error it can't safely recover from, the Unix version of the Blue Screen of Death, and how crash dumps and watchdogs turn it into a fast reboot.
- Least PrivilegeSystems & Tooling
Granting only the permissions actually required, so a compromise has a small ceiling.
- LetterlockingMeaning & Society
Folding, slitting and sealing a letter so the sheet becomes its own tamper-evident envelope.
- MicrocodeSystems & Tooling
The updatable firmware inside a processor that controls how it executes instructions, how operating systems load patches into it at every boot, and the hardware bugs it has been used to fix.
- ProvenanceMethod
The recorded origin of a change or a claim — who made it, when, and on what evidence.
- Right to RepairMeaning & Society
the movement for consumer and independent-shop access to the parts, tools, and information needed to fix a device.
- Secure ShellSystems & Tooling
The encrypted protocol for logging into and running commands on remote machines, authenticated by key pairs, that also tunnels other traffic and underpins Git.
- Supply Chain SecurityVersion Control & Delivery
Protecting against compromise arriving through the code and tooling a project depends on.
- Virtual Private NetworkNetworks & Distribution
An encrypted tunnel that presents a remote network as local, and the narrow set of things a commercial one actually hides.