Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

Post reply on HN
Print view View original

151–160 of 335 posts

Re: Notepad++ drops code signing for its releases

#151

Post by Boulth »

Sephr wrote: post #75
Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

There's a backdoor that lets your bypass the SmartScreen reputation requirement: pay more money for an EV cert[1]. I don't agree with this industry practice. Reputation requirements either shouldn't have backdoors or shouldn't exist in the first place. 1. https://twitter.com/JosephRyanRies/status/951643158118567937

EV code signing certs cost more because they require the private key to be stored exclusively on the hardware token so it's harder to misuse.

Re: Notepad++ drops code signing for its releases

#152

Post by balabaster »

Someone wrote: post #138
balabaster wrote: post #106

Earlier quoted context omitted.

Back in the day, you used to evaluate trust by making smarter decisions about how you went about installing things. You downloaded it to an isolated environment and ran it and proved it didn't cause unexpected side effects. It was run behind a firewall that could log internet communication. If it proved to be good, you ran it in your main environment. If it proved to be bad you warned everyone who would listen to you…

”and proved it didn't cause unexpected side effects.” and convinced yourself it didn't cause unexpected side effects. Put a one month timer in your malware, and this would get past many of such attempts to ‘prove’ the software isn’t evil. Add a few countermeasures against clock shifts (e.g. only be active a few minutes each month or only activate when a) enough time and b) enough user interactions have passed from th…

> and convinced yourself it didn't cause unexpected side effects.

To be fair, with virus proliferation in today's age, we were still more successful with the remedial precautions back then than seems to be the case today.

Re: Notepad++ drops code signing for its releases

#153

Post by Boulth »

GordonS wrote: post #135
Sephr wrote: post #98

Earlier quoted context omitted.

K-Software does not sell EV certificates for $85/yr. They start at $349/yr. The parent comment's issue is that EV certificates are essentially required due to the poorly-designed SmartScreen reputation filter. The $85/yr certificate you're mentioning doesn't help solve this.

I didn't know about the EV workaround and the OP didn't mention it. I've never used an EV cert before for code signing. When we first started, I think Smartscreen was a nuisance for about 2 weeks, but years on, and I've never had to think about it again. Even when we've renewed the cert.

Thanks for taking the time to describe your experience.

When you renewed the cert did you use the same key pair? (I'm wondering how does Microsoft correlate reputation).

Re: Notepad++ drops code signing for its releases

#155

Post by kazinator »

juliusmusseau wrote: post #104
Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

Your trust is misplaced; a developer who drops $$$ on a certificate could be a dyed-in-the-wool criminal. Just because code is signed and certified doesn't mean it doesn't do anything bad.

Signing and certificates revolve around trust/mistrust in the delivery channel not in the purveyor.

That problem can be solved with other tools, like PGP. You don't have to be blackmailed by a platform's certificate racket.

Re: Notepad++ drops code signing for its releases

#156

Post by GordonS »

Boulth wrote: post #153
GordonS wrote: post #135

Earlier quoted context omitted.

I didn't know about the EV workaround and the OP didn't mention it. I've never used an EV cert before for code signing. When we first started, I think Smartscreen was a nuisance for about 2 weeks, but years on, and I've never had to think about it again. Even when we've renewed the cert.

Thanks for taking the time to describe your experience. When you renewed the cert did you use the same key pair? (I'm wondering how does Microsoft correlate reputation).

No, it was a new key pair each time. I'm also rather interested to know how it decides reputation though!

Re: Notepad++ drops code signing for its releases

#157

Post by Spivak »

meditate wrote: post #95
hota_mazi wrote: post #58

Earlier quoted context omitted.

Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.

It doesn't make it inherently safe, but if you are attempting to prove your builds are safe then it is impossible for anyone else to verify that without the source. See the thread on Debian reproducible builds from earlier this week for more discussion on this topic: https://news.ycombinator.com/item?id=19310638 Code signing is something you can do on both open-source or closed-source, but it doesn't prove anything o…

"but it doesn't prove anything other than that a particular build was made by a certain person."

But that's what trust actually is. This IRL person or identity, that I trust, vouches for the non-maliciousness of this application.

Re: Notepad++ drops code signing for its releases

#158

Post by kazinator »

duxup wrote: post #25
fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

The problem is that the software itself is not trustworthy, even if signed, certified and delivered with perfect integrity.

Any scum can pay money to get a certificate; you don't have to pass an ethics examination.

It is just a racket.

Re: Notepad++ drops code signing for its releases

#159

Post by gruez »

ex3ndr wrote: post #133
juliusmusseau wrote: post #126

Earlier quoted context omitted.

My point was I would trust someone who drops $20 more than I would trust someone who drops nothing. $61/yr (USD) will get you an OV cert - there are 10% discount codes that are easy to find for these guys, and their list price is $67/yr: https://codesigning.ksoftware.net/ But the Notepad++ guy will need a business registered with that name before he can obtain CN=Notepad++, no matter how much he's willing to pay.

This certificate doesn't help to bypass UAC and "unsecure" prompt still be shown to the user.

That's incorrect. All code authenticode signing certificates (trusted by microsoft) turns the UAC prompt from yellow to blue. EV certificates is probably for auto-trust for smartscreen.

Re: Notepad++ drops code signing for its releases

#160

Post by kazinator »

close04 wrote: post #49
fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. With attacks getting more and more sophisticated just downloading from the legitimate site no longer guarantees integrity. Sometimes not even having the exe signed does it, with supply chain attacks and code injected long before being signed. Perhaps also posting the hash on a publ…

Yes, simple hashes that are widely disseminated solve the problem from a practical point of view. Someone tampering with a binary executable or installer cannot alter all of the copies of the hash.

A blockchain could be used for that. When you publish something, take its hash, and the add it to a public ledger.

Post reply on HN