21–30 of 335 posts
It seems the author is very focused on signing with x509. I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Right now there are only checksums but no way to verify they are from the author and are distributed on the same server as the binary, so the only security layer is https.
As Windows only project, UAC is the only thing that matters in this equation.
Feels like there's an opportunity for some kind organization to help open-source developers out with this. It shouldn't be this hard for someone trying to give away good work to the world. I used Notepad++ for a long time, and still might if I spent any time in Windows.
Interesting that they will check the hashes of dependencies at runtime. But then I start to wonder - why dynamic linking if the library can't be replaced?
Why bother checking the signature of dependencies if the main executable integrity isn't being checked? What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.
Edit: downvoted? The project is GPL, not a revenue source.
It seems the author is very focused on signing with x509. I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Right now there are only checksums but no way to verify they are from the author and are distributed on the same server as the binary, so the only security layer is https.
Main advantage is that authenticode is built into windows and is easy to verify, unlike PGP. Not to mention that the certificates provide some assurance as to who the real author is, unlike PGP where identities could be generated on demand.
I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…
Is there any evidence that was ever really a thing / effective?
How could you possibly know?
There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from.
That line reads like the absurd advice that security experts put out about "only download something you trust" and ignoring that nobody has a clue how to evaluate that aside form say limiting them self to FOSS and reading all the code...
Earlier quoted context omitted.
It's an obscure product with few providers
Is code signing part of what you get from Apple for your $99 developer fee? If so, then that suddenly feels like a bargain.
I think the issue most people have with the price is that on iOS there's way more limits on running locally without a cert (7 days max), but for someone who is a practicing developer it's really a pretty low cost. If only it came with a mac to develop on...
Interesting that they will check the hashes of dependencies at runtime. But then I start to wonder - why dynamic linking if the library can't be replaced?
Why bother checking the signature of dependencies if the main executable integrity isn't being checked? What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.
It seems the author is very focused on signing with x509. I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Right now there are only checksums but no way to verify they are from the author and are distributed on the same server as the binary, so the only security layer is https.
>(minus the windows UAC thing) As Windows only project, UAC is the only thing that matters in this equation.
register Notepad++ Limited for about £10/$15?