[comex]

It is not just rent; it is a security feature. Whether this feature is being used wisely is another question...

A few months ago I sent Apple security an email about a fake Flash installer with a valid Developer ID certificate. It turned out that someone else had written an article about the same malware five days ago, and reported it to Apple, yet the certificate was not revoked yet - so it doesn't seem that Apple has a 'rapid response' system in place currently (or then, anyway), perhaps because incidents are still relatively uncommon. But they did promptly thank me for my report, and I bet they ended up doing something about it (I ought to check) - and thanks to Developer ID, they at least had some kind of payment trail as well as a name, likely making it harder for the same person to get additional certificates.

Of course, this trail could be achieved with a lower price. But you do get a number of benefits with the subscription, and since the Mac and iOS developer programs merged into one today, at the same $99 as each previously was individually, if you develop for both the price just halved. It's a start, at any rate.

[gruez]

>thanks to Developer ID, they at least had some kind of payment trail as well as a name, likely making it harder for the same person to get additional certificates

What's preventing me from paying some person in a third world country to get a certificate in his name?

[beagle3]

Nothing does. But that person will likely have no loyalty to you, and would give every info he has about you to Apple for an additional $100.

You don't need to be NSA level to hide your tracks there, but it's not trivial either. And Apple is likely to work with the FBI/Interpol about that if whatever evil deeds your software does is sufficiently high profile. Theses guys might also not be good enough to catch you - but they have access to the NSA data for parallel construction, allegedly. And the NSA has incriminating evidence against you.

[coldtea]

Plus that certificate will be revoked pronto.