Notepad++ drops code signing for its releases • Hacker News Board

Re: Notepad++ drops code signing for its releases

#91

Post by godzillabrennus » Thu, Mar 07, 2019, 5:50 PM UTC

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

When were those days?

I remember that 99/100 users didn’t think before installing a free screensaver and got hit with some kind of malware.

While I disagree with how centralized this practice is I’m applauding that an effort is being made to keep malware off consumer devices.

What we need is a decentralized and self policing ecosystem. A Wikipedia of validation.

Something that’s truly monumenta to pull together.

I understand why so many vendors have centralized their efforts.

Re: Notepad++ drops code signing for its releases

#92

Post by mises » Thu, Mar 07, 2019, 5:50 PM UTC

drexlspivey wrote: post #83

tabulatouch wrote: post #73

Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?

You don't get to sign a petition for someone else to work for free

Maybe OP is willing to help. And in any case, it's still useful. What if he's trying to run a FOSS project and doesn't have $500 for a cert? I would say that's different than someone walking around saying "I want".

Re: Notepad++ drops code signing for its releases

#93

Post by throwawaymath » Thu, Mar 07, 2019, 5:51 PM UTC

thanksDr wrote: post #77

throwawaymath wrote: post #59

Earlier quoted context omitted.

Only if that's part of your definition of a good dev. I know plenty of good devs who downloaded software from Sourceforge back when it was big. Let me guess: you also dislike GitHub because it's closed, and wish people would distribute software from their own, self-hosted git repositories?

Devs get better by learning from mistakes. Sourceforge is a hostile source of malware : https://mail.gnome.org/archives/gimp-developer-list/2015-May... You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast.

> You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast.

Oh no, it's the 90s and Micro$oft is evil! They're going to embrace, extend, extinguish all my open source software! I won't be free to develop software anymore!

I'm quite happy with Microsoft, and if supporting GitHub "feeds the beast", then I'm likewise happy to see that beast well-fed.

Re: Notepad++ drops code signing for its releases

#94

Post by duxup » Thu, Mar 07, 2019, 5:51 PM UTC

antsar wrote: post #64

zrobotics wrote: post #33

Earlier quoted context omitted.

>>FOSS and reading all the code... Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.

And compile your compiler, and ... (In reference to the classic paper: https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7... )

Also considering the layers of hardware with layers of firmware. ... I should probabbly learn something about that too....

I'm thinking along the lines of google's blog on Meltdown and Spectre recently that basically said if two things are on the same processor.... there's nothing you can do now security wise and be sure about it.

Re: Notepad++ drops code signing for its releases

#95

Post by meditate » Thu, Mar 07, 2019, 5:51 PM UTC

hota_mazi wrote: post #58

duxup wrote: post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.

It doesn't make it inherently safe, but if you are attempting to prove your builds are safe then it is impossible for anyone else to verify that without the source. See the thread on Debian reproducible builds from earlier this week for more discussion on this topic: https://news.ycombinator.com/item?id=19310638

Code signing is something you can do on both open-source or closed-source, but it doesn't prove anything other than that a particular build was made by a certain person.

Re: Notepad++ drops code signing for its releases

#96

Post by mises » Thu, Mar 07, 2019, 5:52 PM UTC

herf wrote: post #52

Could post to Microsoft Store, which would let them do this for free.

This might be an option, but it's a lot of extra work for only a portion of the users. Only works on Windows 10.

Re: Notepad++ drops code signing for its releases

#97

Post by asveikau » Thu, Mar 07, 2019, 5:54 PM UTC

captainredbeard wrote: post #54

asveikau wrote: post #3

Interesting that they will check the hashes of dependencies at runtime. But then I start to wonder - why dynamic linking if the library can't be replaced?

Another major benefit of dynamic linking is that multiple processes can share the same dylib in memory -- for things like Apple's AppKit.framework, that can add up to significant savings when multiplied across all of the open apps. https://www.quora.com/What-is-the-difference-between-static-...

I believe recent Windows and other recent OSs can hash the contents of pages and de-dupe them, which could have some benefits for the same library linked statically across multiple binaries, assuming the identical code ends up page aligned in the same way. This strategy also has benefits for running VMs with the same OS loaded multiple times.

See: https://en.wikipedia.org/wiki/Kernel_same-page_merging

Re: Notepad++ drops code signing for its releases

#98

Post by Sephr » Thu, Mar 07, 2019, 5:55 PM UTC

GordonS wrote: post #86

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

You can get a certificate far cheaper than that - K-Software offer them for $85/year. I've used them for years and can recommend them.

K-Software does not sell EV certificates for $85/yr. They start at $349/yr.

The parent comment's issue is that EV certificates are essentially required due to the poorly-designed SmartScreen reputation filter. The $85/yr certificate you're mentioning doesn't help solve this.

Re: Notepad++ drops code signing for its releases

#99

Post by AnIdiotOnTheNet » Thu, Mar 07, 2019, 5:56 PM UTC

EpicEng wrote: post #63

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

"the good old days", as in, "the days when the average person had no freaking clue if something was safe, but installed it anyway because it's completely unreasonable to expect them to do otherwise"? If your security model is "do your research" then you're going to fail.

Just because someone certifies that it wasn't tampered with and comes from who it says it does doesn't mean it is safe.

Re: Notepad++ drops code signing for its releases

#100

Post by flohofwoe » Thu, Mar 07, 2019, 5:56 PM UTC

GordonS wrote: post #86

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

You can get a certificate far cheaper than that - K-Software offer them for $85/year. I've used them for years and can recommend them.

IME Windows SmartScreen still gives a scare-warning for software that's signed with a valid certificate, unless some magic "reputation-threshold" is reached and who-knows what factors into this.

The current code-signing-certificate model is pointless, regardless of price.