Notepad++ drops code signing for its releases • Hacker News Board

Re: Notepad++ drops code signing for its releases

#141

Post by [deleted] » Thu, Mar 07, 2019, 6:25 PM UTC

asveikau wrote: post #127

maccam94 wrote: post #119

Earlier quoted context omitted.

That requires all of the apps to be built with the same exact version of the library.

So does hashing the DLLs before you load them, negating much of the purpose of dynamic linking. That was my point. Anyway if you really want to get technical, if your sharing method is hashing identical pages, I would bet that you don't actually need the same version of the lib to get nonzero sharing. I would not be surprised if many libs have large ranges of identical pages across point releases. Then it's more a qu…

[deleted]

Re: Notepad++ drops code signing for its releases

#142

Post by oarsinsync » Thu, Mar 07, 2019, 6:28 PM UTC

0815test wrote: post #117

hota_mazi wrote: post #58

Earlier quoted context omitted.

Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.

If your compiler correctly enforces security properties (and many languages do attempt to do this, at least in well-defined "safe" subsets), then of course any source code compiled with it is going to be safe. It's the difference between the JavaScript/WASM JIT-powered sandbox on the one hand, and the ActiveX code-signing-based model on the other. Which is safer?

I can visit a website and my CPU can get hammered to mine cryptocurrency for someone else without my consent.

I'm not sure either is that much better at this point!

Re: Notepad++ drops code signing for its releases

#143

Post by smallbigfish » Thu, Mar 07, 2019, 6:28 PM UTC

magnat wrote: post #61

techsupporter wrote: post #55

Earlier quoted context omitted.

Yep and sometimes the name people know isn't the name that a CA will permit in a certificate. I have one of those. I'm known as a shortened version of my middle name, say Jack Quimby, but DigiCert and others insist that the cert be issued to Alphonse Jackson Quimby, Jr. OK I'll just buy an LLC from a state that's cheap (never mind the paperwork) but that's no good either because the new entity had no listed phone num…

>OK I'll just buy an LLC When I bought code signing certificate for my LLC, in their infinite wisdom CA put "Spółka z ograniczoną odpowiedzialnością" as CN, because that's what they saw on proof of ownership. "Spółka z ograniczoną odpowiedzialnością" literally means "Limited liability company" in Polish.

But they "spend hundreds" on checking the validity of the requester.

Re: Notepad++ drops code signing for its releases

#144

Post by fbelzile » Thu, Mar 07, 2019, 6:28 PM UTC

I'm going through a "renewal" right now... The archaic maze of validation is also getting on my nerves. It's been three weeks now that I'm waiting for a phone call to validate my phone number. This article is making it so tempting to cancel my order.

The plethora of support emails is what motivated me to get one in the first place. I used to get accused of giving users a "virus" and getting into infinite loops on why they should trust me. I'm sure I was wasting more than $100/year of my time responding to these emails, so I just gave in and got one.

Now, I don't know what to do.

Re: Notepad++ drops code signing for its releases

#145

Post by Skunkleton » Thu, Mar 07, 2019, 6:28 PM UTC

1wd wrote: post #57

criddell wrote: post #16

Earlier quoted context omitted.

Why bother checking the signature of dependencies if the main executable integrity isn't being checked? What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.

The opposite would surprise me. How would Notepad++ earn any money?

Redhat is an example of a company that makes money on top of extensive open source contributions. I doubt a similar model would work for a text editor. There is a reason most open source projects like this have a corporate benefactor.

Re: Notepad++ drops code signing for its releases

#146

Post by burtonator » Thu, Mar 07, 2019, 6:28 PM UTC

I created a huge rant on code signing certificates here:

https://www.youtube.com/watch?v=mwuk0E-tfeg

It's a nightmare. Complete scam.

I needed this for Polar: https://getpolarized.io/

Mind you... it's Open Source but I still want my users to be able to download it without warnings.

No joke - it took me 2 weeks to get the CSC with about 4 hours per day working on just this CSC issue.

It's just a labyrinth of insanity from not having a listing on D&B to them insisting I pay $2k to expedite it.

I still don't have one from Apple because it requires a D&B number so I had to get a personal cert from them.

I went with a cheap one for Windows BUT it gives errors on install for like the first 1k downloads until Windows says it's legit.

It's a complete scam.

BTW.. if you get in the MS App Store you don't have to worry about a CSC so that's good I guess.

Re: Notepad++ drops code signing for its releases

#147

Post by wil421 » Thu, Mar 07, 2019, 6:29 PM UTC

wozer wrote: post #116

In Germany, Notepad++ is ubiquitous on Windows computers (every developer has it). Is it like this in the US, too?

SublimeText is common. I’ve converted a few devs over from Notepad++. A SublimeText license is cheap if you’re in the US/EU but I could see it being expensive for the devolving nations. You can evaluate SublimeText for free and I encourage you to do so. Check out the packages for your stack!

After using SublimeText for 5 years, notepad++ is like using a regular notepad but that’s my personal opinion.

Re: Notepad++ drops code signing for its releases

#148

Post by jacekm » Thu, Mar 07, 2019, 6:30 PM UTC

gruez wrote: post #2

Why not use something like certum[1]? It's $69/year (cheaper if you already have a smartcard), but the CN ends up with something like "Open source developer, [full name]". It's not "notepad++" like the author wants, but it's still better than nothing. [1] https://en.sklep.certum.pl/data-safety/code-signing-certific... edit: updated price

They've already tried it https://twitter.com/Notepad_plus/status/1098519332852822016

Re: Notepad++ drops code signing for its releases

#149

Post by k32sic » Thu, Mar 07, 2019, 6:34 PM UTC

close04 wrote: post #49

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. With attacks getting more and more sophisticated just downloading from the legitimate site no longer guarantees integrity. Sometimes not even having the exe signed does it, with supply chain attacks and code injected long before being signed. Perhaps also posting the hash on a publ…

I will always put more trust to downloads form web sites that have an owner, than apps coming from an app store. It is very easy to put my trust in an app when I see the amount of work has been put in setting up a site (documentation, history of development, etc).

The app stores do not offer any kind of information that would help to put my trust in the developer and application.

Certifactes are a fallacy that tell nothing about the security of the app. They just tell that the app was signed someone that has a security certificate.

Also why do all security experts want to shove their security agenda to the world ? If you are dealing with life or death matter than it is probably better not to expose your world to the wild. For everything else it is OK to live without the safety net, it is OK if someone looses some money or your mum's disk gets encrypted. People fall every day and I sencerly hope that there will not be some police that will force you to wear a helmet ass soon as you get out of the bed.

Re: Notepad++ drops code signing for its releases

#150

Post by GordonS » Thu, Mar 07, 2019, 6:36 PM UTC

flohofwoe wrote: post #100

GordonS wrote: post #86

Earlier quoted context omitted.

You can get a certificate far cheaper than that - K-Software offer them for $85/year. I've used them for years and can recommend them.

IME Windows SmartScreen still gives a scare-warning for software that's signed with a valid certificate, unless some magic "reputation-threshold" is reached and who-knows what factors into this. The current code-signing-certificate model is pointless, regardless of price.

I didn't realise that. We released desktop software several years ago, and customers/trialers did report that Smartscreen was flagging it for a couple I'd weeks. Never had an issue since then though.

Having said that, Smartscreen is opaque, and a nuisance.