> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors
What does that mean?
Notepad++ drops code signing for its releases
11–20 of 335 posts
Re: Notepad++ drops code signing for its releases
#12It seems the author is very focused on signing with x509.
I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Right now there are only checksums but no way to verify they are from the author and are distributed on the same server as the binary, so the only security layer is https.
Re: Notepad++ drops code signing for its releases
#13register Notepad++ Limited for about £10/$15?
Re: Notepad++ drops code signing for its releases
#14Why not use something like certum[1]? It's $69/year (cheaper if you already have a smartcard), but the CN ends up with something like "Open source developer, [full name]". It's not "notepad++" like the author wants, but it's still better than nothing. [1] https://en.sklep.certum.pl/data-safety/code-signing-certific... edit: updated price
"It's $828 per year" for ... a cert? What makes code signing this expensive?
It's an obscure product with few providers
Re: Notepad++ drops code signing for its releases
#15> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors. I'm not sure what the author means by this.
The author is saying that signing certificates are something that FOSS authors enjoy using, but they have no practical purpose outside of that enjoyment.
Re: Notepad++ drops code signing for its releases
#16Interesting that they will check the hashes of dependencies at runtime. But then I start to wonder - why dynamic linking if the library can't be replaced?
Why bother checking the signature of dependencies if the main executable integrity isn't being checked?
What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.
Re: Notepad++ drops code signing for its releases
#17I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe.
Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device.
These practices are anticompetitive and monopolistic.
Good for Notepad++. I couldnt agree more with its sentiment.
Re: Notepad++ drops code signing for its releases
#18Why not use something like certum[1]? It's $69/year (cheaper if you already have a smartcard), but the CN ends up with something like "Open source developer, [full name]". It's not "notepad++" like the author wants, but it's still better than nothing. [1] https://en.sklep.certum.pl/data-safety/code-signing-certific... edit: updated price
"It's $828 per year" for ... a cert? What makes code signing this expensive?
Greed, mostly.
Digicert lists EV code signing certs as $664/yr. But if you are to enter their site through a side door or just plainly cry into the support's jacket, then the price magically drops to $104/yr. And that's for an EV cert! So the only reason there are $600 certs is that there are people who do pay that.
Re: Notepad++ drops code signing for its releases
#19Re: Notepad++ drops code signing for its releases
#20> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors. I'm not sure what the author means by this.
Codesigning certs are a racket... the 'chain of trust' and documentation requirements mean they are expensive and hard to get as an individual, yet oh-so-essential for releasing software. Which also makes them status symbols, which the author is rejecting.
I kind of see them like taxi medallions