Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

Post reply on HN
Print view View original

101–110 of 335 posts

Re: Notepad++ drops code signing for its releases

#101

Post by Someone1234 »

Sephr wrote: post #75
Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

There's a backdoor that lets your bypass the SmartScreen reputation requirement: pay more money for an EV cert[1]. I don't agree with this industry practice. Reputation requirements either shouldn't have backdoors or shouldn't exist in the first place. 1. https://twitter.com/JosephRyanRies/status/951643158118567937

The Reputation requirement exists simply because there's CAs in the Windows certificate store that aren't super trustworthy, and frankly that malware could seek to get a code signing certificate.

Arguably the Reputation requirement is more helpful than the information held in the certificate, since Reputation is hard to fake whereas that information is provided by the requestor and its validation depends on the CA's processes (which as I said varies wildly).

It is one of those "greater good" things. It does suck for FOSS however.

Re: Notepad++ drops code signing for its releases

#102

Post by duxup »

detaro wrote: post #80
thanksDr wrote: post #77

Earlier quoted context omitted.

Devs get better by learning from mistakes. Sourceforge is a hostile source of malware : https://mail.gnome.org/archives/gimp-developer-list/2015-May... You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast.

was , not is. Sourceforge has changed hands since then.

Yeah my understanding is after it changed hands they did away with all the nasty stuff that happened in the past.

Re: Notepad++ drops code signing for its releases

#103

Post by blibble »

tonyedgecombe wrote: post #30
blibble wrote: post #13

register Notepad++ Limited for about £10/$15?

That comes with a ton of additional bureaucratic work.

in the UK a company takes about 10 minutes to setup and if not actively trading requires about 5 minutes of work per year to keep going

Re: Notepad++ drops code signing for its releases

#104

Post by juliusmusseau »

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20.

Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public directory (e.g., bbb.org), and someone representing your business needs to pick up that phone when the cert validator calls it.

Your business name and physical address are injected into the certificate. Basically code-signing certificates make it easier for people to find you and sue you if they truly want to. I suspect that's the whole point.

The problem here is that the Notepad++ developer wants his certificate to say CN=Notepad++, but he won't be able to obtain that until he has some kind of business or organization registered in his jurisdiction with that name. Whereas CN=FIRSTNAME LASTNAME he could probably obtain immediately (just send in his driver's license during validation).

Re: Notepad++ drops code signing for its releases

#105

Post by Sephr »

Someone1234 wrote: post #101
Sephr wrote: post #75

Earlier quoted context omitted.

There's a backdoor that lets your bypass the SmartScreen reputation requirement: pay more money for an EV cert[1]. I don't agree with this industry practice. Reputation requirements either shouldn't have backdoors or shouldn't exist in the first place. 1. https://twitter.com/JosephRyanRies/status/951643158118567937

The Reputation requirement exists simply because there's CAs in the Windows certificate store that aren't super trustworthy, and frankly that malware could seek to get a code signing certificate. Arguably the Reputation requirement is more helpful than the information held in the certificate, since Reputation is hard to fake whereas that information is provided by the requestor and its validation depends on the CA's…

I'm not arguing against reputation requirements, I'm arguing for consistency.

EV certificates are literally a reputation requirement backdoor.

If EV-signed apps had to deal with the same SmartScreen reputation requirements as non-EV-signed apps, Microsoft might actually have to address this issue brought up in the parent comment:

> Every time you have to get a new one, with same story of "reputation" again.

Re: Notepad++ drops code signing for its releases

#106

Post by balabaster »

duxup wrote: post #25
fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

Back in the day, you used to evaluate trust by making smarter decisions about how you went about installing things.

You downloaded it to an isolated environment and ran it and proved it didn't cause unexpected side effects. It was run behind a firewall that could log internet communication. If it proved to be good, you ran it in your main environment. If it proved to be bad you warned everyone who would listen to you.

I feel like the more "social" the web appears to be becoming, the less social it actually is. We had tight little BBS and IRC communities where this stuff was all discussed. Social meant we actually had meaningful conversations... okay, not always meaningful, but it was often about the pursuit of something useful.

It's nigh on impossible with the proliferation of the internet to take this approach these days. Things just didn't scale that well. This is why things like DD-WRT and other hacker sites while being more accessible are still very much a niche market.

It's funny how much more technical you had to be back then just to get online. It's as if we're driving the automatic version of the internet now. Back then we had cobble all the pieces together and even when you had, it was like driving with a manual gearshift.

Re: Notepad++ drops code signing for its releases

#107

Post by miles »

thanksDr wrote: post #77
throwawaymath wrote: post #59

Earlier quoted context omitted.

Only if that's part of your definition of a good dev. I know plenty of good devs who downloaded software from Sourceforge back when it was big. Let me guess: you also dislike GitHub because it's closed, and wish people would distribute software from their own, self-hosted git repositories?

Devs get better by learning from mistakes. Sourceforge is a hostile source of malware : https://mail.gnome.org/archives/gimp-developer-list/2015-May... You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast.

That was true back in 2015. New owners have been cleaning it up since 2016:

Under new management, SourceForge moves to put badness in past https://arstechnica.com/information-technology/2016/06/under...

Re: Notepad++ drops code signing for its releases

#109

Post by [deleted] »

UncleMeat wrote: post #42
fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

I am absolutely confident that the overwhelming majority of people have never evaluated the safety of an exe in their life and could not tell you how to do it even if they wanted to. Things that work for security-aware software engineers don't work for billions of people.

[deleted]

Re: Notepad++ drops code signing for its releases

#110

Post by Sephr »

juliusmusseau wrote: post #104
Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

> Even if it's just $20.

$20 doesn't get you an EV certificate anywhere.

We're talking about non-trivial hundreds of dollars per year, which is completely unsustainable for an open source driver for example.

Post reply on HN