Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

Post reply on HN
Print view View original

111–120 of 335 posts

Re: Notepad++ drops code signing for its releases

#111

Post by GordonS »

kpcyrd wrote: post #12

It seems the author is very focused on signing with x509. I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Right now there are only checksums but no way to verify they are from the author and are distributed on the same server as the binary, so the only security layer is https.

> would work just as well (minus the windows UAC thing)

The blue UAC prompt and no warning message is the main point, though.

In theory users could manually verify a PGP-signed executable, but that's well outside of the average Windows user's knowledge.

Re: Notepad++ drops code signing for its releases

#112

Post by miles »

fjabre wrote: post #41
zrobotics wrote: post #33

Earlier quoted context omitted.

>>FOSS and reading all the code... Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.

Every good dev knows to stay the hell away from sourceforge!

Logan Abbott[0] bought SourceForge back in 2016 and has been cleaning it up ever since[1]:

> Hi, president of SourceForge here. Glad this is trending, albeit a few months later. These articles seem to trend on HN every few months, with many people not realizing SourceForge changed ownership in 2016 and that the new team's been working hard on improving. To be clear, we had nothing to do with the bundled adware decisions of 2015, and when we took over in 2016, the first thing we did was remove the bundled adware, as well as institute malware scans for every project on the site. We're working hard to restore trust, so if we win some of you back that would be cool. However, we're just focused on doing right by our million daily users.

[0] https://news.ycombinator.com/user?id=loganabbott

[1] https://news.ycombinator.com/item?id=17592523

Re: Notepad++ drops code signing for its releases

#113

Post by Someone1234 »

tabulatouch wrote: post #73

Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?

Code Signing is more akin to EV than domain verified.

They're checking organisational or individual identity, which is a work intensive process (e.g. "email me your driver's license, business license, and tax return so I can manually review them.")

It might be possible for a charity to run a FOSS code signing CA, but it is unclear who's paying for that since it needs actual staff.

Re: Notepad++ drops code signing for its releases

#114

Post by msla »

juliusmusseau wrote: post #104
Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

> Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20.

Why? If I expect to make four figures on spreading malware/adware, and I can assuage the nerves of people like you by spending two or three figures on a certificate, I'm going to buy the certificate and make it look all nice and pretty and take your money.

> Your business name and physical address are injected into the certificate. Basically code-signing certificates make it easier for people to find you and sue you if they truly want to. I suspect that's the whole point.

So I have to incorporate in Delaware, make up a fake address, and rent a burner phone for a while. I'm not seeing the downside.

https://www.bizfilings.com/toolkit/research-topics/incorpora...

> Delaware does not require director names and addresses to be listed in the Certificate of Incorporation.

Re: Notepad++ drops code signing for its releases

#115

Post by gambler »

smarx007 wrote: post #90
gambler wrote: post #84

Earlier quoted context omitted.

LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with encryption, so having analogous CA for code would be entirely meaningless. What does code signing in Windows actually verify? That executable's author at some point paid money to some company that Microsoft deemed an "authority"? It's a rotten system. The whole C…

No, it verifies that the certificate was issued to someone whose ID was checked. Money is paid for the covering the bureaucratic costs and keeping the records etc.

Problem is, this assumes that all CAs and their resellers do that verification properly.

https://security.googleblog.com/2015/03/maintaining-digital-...

https://arstechnica.com/information-technology/2017/11/evasi...

"The third key weakness in the code-signing ecosystem was the failure of certificate authorities to verify the identities of people applying for code-signing certificates. Twenty-seven certificates in the group of 111 misappropriated certificates that the researchers identified fell into this class. Twenty-two of the certificates were improperly issued as a result of identity theft of a legitimate company. In some cases, malicious actors impersonated legitimate companies, in some cases ones that had no involvement at all in publishing software. In the remaining five cases, the certificates were issued to fraudulent shell companies. "

Re: Notepad++ drops code signing for its releases

#117

Post by 0815test »

hota_mazi wrote: post #58
duxup wrote: post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.

If your compiler correctly enforces security properties (and many languages do attempt to do this, at least in well-defined "safe" subsets), then of course any source code compiled with it is going to be safe. It's the difference between the JavaScript/WASM JIT-powered sandbox on the one hand, and the ActiveX code-signing-based model on the other. Which is safer?

Re: Notepad++ drops code signing for its releases

#118

Post by theandrewbailey »

gambler wrote: post #84
tabulatouch wrote: post #73

Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?

LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with encryption, so having analogous CA for code would be entirely meaningless. What does code signing in Windows actually verify? That executable's author at some point paid money to some company that Microsoft deemed an "authority"? It's a rotten system. The whole C…

> LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification".

Have you used Let's Encrypt? It verifies that you own the domain in question. HTTPS requires that the server you're connecting to has been identified.

Re: Notepad++ drops code signing for its releases

#119

Post by maccam94 »

asveikau wrote: post #97
captainredbeard wrote: post #54

Earlier quoted context omitted.

Another major benefit of dynamic linking is that multiple processes can share the same dylib in memory -- for things like Apple's AppKit.framework, that can add up to significant savings when multiplied across all of the open apps. https://www.quora.com/What-is-the-difference-between-static-...

I believe recent Windows and other recent OSs can hash the contents of pages and de-dupe them, which could have some benefits for the same library linked statically across multiple binaries, assuming the identical code ends up page aligned in the same way. This strategy also has benefits for running VMs with the same OS loaded multiple times. See: https://en.wikipedia.org/wiki/Kernel_same-page_merging

That requires all of the apps to be built with the same exact version of the library.

Re: Notepad++ drops code signing for its releases

#120

Post by SamuelAdams »

criddell wrote: post #16
asveikau wrote: post #3

Interesting that they will check the hashes of dependencies at runtime. But then I start to wonder - why dynamic linking if the library can't be replaced?

Why bother checking the signature of dependencies if the main executable integrity isn't being checked? What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.

Could be related to the CIA replacing common libraries with their own.

https://notepad-plus-plus.org/news/notepad-7.3.3-fix-cia-hac...

Post reply on HN