Notepad++ drops code signing for its releases • Hacker News Board

Re: Notepad++ drops code signing for its releases

#61

Post by magnat » Thu, Mar 07, 2019, 5:31 PM UTC

techsupporter wrote: post #55

magnat wrote: post #47

Earlier quoted context omitted.

It's not about the price, but about name on the certificate: > However I cannot use "Notepad++" as CN to sign because Notepad++ doesn’t exist as company or organization CAs would put author's name as CN, which isn't great, especially for collaborative project.

Yep and sometimes the name people know isn't the name that a CA will permit in a certificate. I have one of those. I'm known as a shortened version of my middle name, say Jack Quimby, but DigiCert and others insist that the cert be issued to Alphonse Jackson Quimby, Jr. OK I'll just buy an LLC from a state that's cheap (never mind the paperwork) but that's no good either because the new entity had no listed phone num…

>OK I'll just buy an LLC

When I bought code signing certificate for my LLC, in their infinite wisdom CA put "Spółka z ograniczoną odpowiedzialnością" as CN, because that's what they saw on proof of ownership. "Spółka z ograniczoną odpowiedzialnością" literally means "Limited liability company" in Polish.

Re: Notepad++ drops code signing for its releases

#62

Post by cm2187 » Thu, Mar 07, 2019, 5:31 PM UTC

tomc1985 wrote: post #22

draw_down wrote: post #7

Feels like there's an opportunity for some kind organization to help open-source developers out with this. It shouldn't be this hard for someone trying to give away good work to the world. I used Notepad++ for a long time, and still might if I spent any time in Windows.

I wonder if Lets Encrypt is working on code-signing certs? That would be a huge win for FOSS

How would let's encrypt verify the identity of the author?

Re: Notepad++ drops code signing for its releases

#63

Post by EpicEng » Thu, Mar 07, 2019, 5:31 PM UTC

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

"the good old days", as in, "the days when the average person had no freaking clue if something was safe, but installed it anyway because it's completely unreasonable to expect them to do otherwise"?

If your security model is "do your research" then you're going to fail.

Re: Notepad++ drops code signing for its releases

#64

Post by antsar » Thu, Mar 07, 2019, 5:32 PM UTC

zrobotics wrote: post #33

duxup wrote: post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

>>FOSS and reading all the code... Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.

And compile your compiler, and ...

(In reference to the classic paper: https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...)

Re: Notepad++ drops code signing for its releases

#65

Post by sephoric » Thu, Mar 07, 2019, 5:33 PM UTC

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

The days of custom software are over in general. Every major niche has at least one major player that offers its services for free, selling your data (or ads, etc) in exchange. I'm not sure Sublime Text gets any money anymore now that VS Code does all the same things and more. Custom music players have been dead since Winamp 3. The 1990s and 2000s were like the Wild West for software, now it's like California, fully settled and complete with monopolies.

Re: Notepad++ drops code signing for its releases

#66

Post by throwawaymath » Thu, Mar 07, 2019, 5:34 PM UTC

duxup wrote: post #25

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

> absurd advice that security experts put out about "only download something you trust"

This is mostly a meme from the overzealous FOSS and privacy crowd, not the security crowd. Professional security engineers do not, as a rule, encourage software engineers (or end users more generally) to only use open source software because "you can inspect the code for vulnerabilities."

Anyone with legitimate security expertise will understand the benefits of specialization and core competencies. Namely that despite the ideological perspective of many in the FOSS community, it is actually better to trust someone else with the security of your software. Because you most likely can't trust yourself with that task anyway.

The idea that most people can reliably identify security vulnerabilities in the software they use just because it's open source is laughable. They might find trivial low hanging fruit or obvious malicious activity, but they won't have a better picture of the overall security posture just because they can read the code.

As an obvious case in point, consider how few people identify vulnerabilities in Firefox versus how many people use Firefox. The people who write complex open source software don't even reliably find the issues in their own code.

Re: Notepad++ drops code signing for its releases

#67

Post by 1wd » Thu, Mar 07, 2019, 5:34 PM UTC

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

Also code signing doesn't automatically lead to the "blue-trusted UAC popup" anymore anyway.

Re: Notepad++ drops code signing for its releases

#68

Post by ars » Thu, Mar 07, 2019, 5:34 PM UTC

cm2187 wrote: post #62

tomc1985 wrote: post #22

Earlier quoted context omitted.

I wonder if Lets Encrypt is working on code-signing certs? That would be a huge win for FOSS

How would let's encrypt verify the identity of the author?

They could sign an email address instead of a name.

Re: Notepad++ drops code signing for its releases

#69

Post by jarjoura » Thu, Mar 07, 2019, 5:34 PM UTC

herf wrote: post #52

Could post to Microsoft Store, which would let them do this for free.

I think if I remember correctly, they were opposed going the store route because it took too much effort building on top of the store sandbox and new installer packaging.

Re: Notepad++ drops code signing for its releases

#70

Post by Svoka » Thu, Mar 07, 2019, 5:35 PM UTC

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again.

[1] https://www.digicert.com/order/order-1.php