Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

81–90 of 335 posts

Re: Notepad++ drops code signing for its releases

#81
post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

> absurd advice that security experts put out about "only download something you trust" This is mostly a meme from the overzealous FOSS and privacy crowd, not the security crowd. Professional security engineers do not, as a rule, encourage software engineers (or end users more generally) to only use open source software because "you can inspect the code for vulnerabilities." Anyone with legitimate security expertise…

Yeah I didn't intend to tie FOSS advice to the security comment but inadvertently my comment reads like that.

I intended it to just be a comparison of the "only download something you trust" absurd advice you get from "security" people you see on TV or something... and what the user was suggesting about the old days.

My FOSS comment was really meant to reflect the absolute rabbit hole you go down when it is suggested people can simply protect themselves. It's never ending flow of tasks and things you need to know that I don't think anyone can do ...

Re: Notepad++ drops code signing for its releases

#82
post #61

Earlier quoted context omitted.

Yep and sometimes the name people know isn't the name that a CA will permit in a certificate. I have one of those. I'm known as a shortened version of my middle name, say Jack Quimby, but DigiCert and others insist that the cert be issued to Alphonse Jackson Quimby, Jr. OK I'll just buy an LLC from a state that's cheap (never mind the paperwork) but that's no good either because the new entity had no listed phone num…

>OK I'll just buy an LLC When I bought code signing certificate for my LLC, in their infinite wisdom CA put "Spółka z ograniczoną odpowiedzialnością" as CN, because that's what they saw on proof of ownership. "Spółka z ograniczoną odpowiedzialnością" literally means "Limited liability company" in Polish.

I know that must have been a pain in the neck for you, but that's hilarious. Thanks for sharing!

Re: Notepad++ drops code signing for its releases

#84

Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?

LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with encryption, so having analogous CA for code would be entirely meaningless.

What does code signing in Windows actually verify? That executable's author at some point paid money to some company that Microsoft deemed an "authority"?

It's a rotten system. The whole CA pyramid is bullshit.

What we really need is a way to know that executable notepad++2.0 is signed by the same person who signed notepad++1.0 already installed on your computer, and that it's the same person who controls notepad-plus-plus.org, and that this identity has existed for well over 10 years. This is legitimately useful info that would allow people to make more informed decisions about what to install.

BTW, the part about historic record seems like one of the few good uses for blockchain technology.

Re: Notepad++ drops code signing for its releases

#85
post #2

Why not use something like certum[1]? It's $69/year (cheaper if you already have a smartcard), but the CN ends up with something like "Open source developer, [full name]". It's not "notepad++" like the author wants, but it's still better than nothing. [1] https://en.sklep.certum.pl/data-safety/code-signing-certific... edit: updated price

[deleted]

Re: Notepad++ drops code signing for its releases

#86
post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

You can get a certificate far cheaper than that - K-Software offer them for $85/year.

I've used them for years and can recommend them.

Re: Notepad++ drops code signing for its releases

#87
post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

Are you kidding me? Have you never done family support the last 15 years?...

Re: Notepad++ drops code signing for its releases

#88

Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?

Absolutely agree, though the "reputation" racket remains. The problem with EV (and the reason why Let's Encrypt doesn't provide them for SSL) is that such certificates must be tied to a legal entity.

Re: Notepad++ drops code signing for its releases

#89

Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?

I asked about this before, a while back. I seem to recall they said they won't do it, because the verification required is completely different - they'd need to verify your organisation, rather than a domain.

Re: Notepad++ drops code signing for its releases

#90
post #84

Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?

LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with encryption, so having analogous CA for code would be entirely meaningless. What does code signing in Windows actually verify? That executable's author at some point paid money to some company that Microsoft deemed an "authority"? It's a rotten system. The whole C…

No, it verifies that the certificate was issued to someone whose ID was checked. Money is paid for the covering the bureaucratic costs and keeping the records etc.
Post reply on HN