Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

Post reply on HN
Print view View original

41–50 of 335 posts

Re: Notepad++ drops code signing for its releases

#41

Post by fjabre »

zrobotics wrote: post #33
duxup wrote: post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

>>FOSS and reading all the code... Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.

Every good dev knows to stay the hell away from sourceforge!

Re: Notepad++ drops code signing for its releases

#42

Post by UncleMeat »

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

I am absolutely confident that the overwhelming majority of people have never evaluated the safety of an exe in their life and could not tell you how to do it even if they wanted to. Things that work for security-aware software engineers don't work for billions of people.

Re: Notepad++ drops code signing for its releases

#43

Post by tomc1985 »

gruez wrote: post #40
tomc1985 wrote: post #20

Earlier quoted context omitted.

Codesigning certs are a racket... the 'chain of trust' and documentation requirements mean they are expensive and hard to get as an individual, yet oh-so-essential for releasing software. Which also makes them status symbols, which the author is rejecting. I kind of see them like taxi medallions

>I kind of see them like taxi medallions Taxi medallions are pricey because there's limited supply and high demand. Code signing certificates have limited demand and unlimited supply, but are expensive because they require manual verification (like EV certificates) and has a bunch of startup costs (to get included as a root).

Factors keep both items expensive, and both are effectively required for doing certain types of business.

Re: Notepad++ drops code signing for its releases

#44

Post by ratling »

tomc1985 wrote: post #20
jimktrains2 wrote: post #5

> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors. I'm not sure what the author means by this.

Codesigning certs are a racket... the 'chain of trust' and documentation requirements mean they are expensive and hard to get as an individual, yet oh-so-essential for releasing software. Which also makes them status symbols, which the author is rejecting. I kind of see them like taxi medallions

The one place they have value is for people who have macbooks that are locked down to only allow app store/signed dmgs to run. TBH though since corp control of OSX is janky to begin with devs will usually figure out a workaround (or scream loud enough that this gets reverted, no one likes to pay for devs to sit around doing nothing).

Re: Notepad++ drops code signing for its releases

#45

Post by roywiggins »

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

which days? when people were cheerfully downloading and running keygen executables to crack their Photoshop trials?

Re: Notepad++ drops code signing for its releases

#46

Post by prepend »

kpcyrd wrote: post #29
mariusmg wrote: post #21

Earlier quoted context omitted.

>(minus the windows UAC thing) As Windows only project, UAC is the only thing that matters in this equation.

I've just edited my comment to make this clearer. Doing code signing with signify or pgp gives you a way the verify the binary you downloaded is actually the file the developer built on their laptop, even if the webserver is compromised. Linux ISOs are very commonly distributed that way. I agree that it's extremely uncommon for windows users to verify this though.

Windows does not care about non-windows recognized signatures.

So this works fine for users who care about gpg verification, but fails the “Windows doesn’t prompt me about insecure stuff” test.

Re: Notepad++ drops code signing for its releases

#47

Post by magnat »

criddell wrote: post #16
asveikau wrote: post #3

Interesting that they will check the hashes of dependencies at runtime. But then I start to wonder - why dynamic linking if the library can't be replaced?

Why bother checking the signature of dependencies if the main executable integrity isn't being checked? What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.

It's not about the price, but about name on the certificate:

> However I cannot use "Notepad++" as CN to sign because Notepad++ doesn’t exist as company or organization

CAs would put author's name as CN, which isn't great, especially for collaborative project.

Re: Notepad++ drops code signing for its releases

#48

Post by duxup »

fjabre wrote: post #37
duxup wrote: post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

Of course but all of the above mentioned can still happen and does happen today with all security measures in place. With the added benefit that we must ask permission of a private entity to release an app and we must pay 30% of our profits to the gatekeepers /s I think I like the old way better.

I don't think I understand what the difference is with the "old way" if as you describe it ... there seems to be no difference. You don't have to pay some cert provider under the old or current way.

Re: Notepad++ drops code signing for its releases

#49

Post by close04 »

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe.

With attacks getting more and more sophisticated just downloading from the legitimate site no longer guarantees integrity. Sometimes not even having the exe signed does it, with supply chain attacks and code injected long before being signed.

Perhaps also posting the hash on a public website (a tweet for example) 24h before making the installer available would mitigate the code signing issue. You could use it as an authoritative source that's less likely to be breached/modified after posting without immediately raising flags. And if it was an unauthorized post the 24h also gives the author enough time to flag it. Supply chain attacks are not considered here.

Post reply on HN