Notepad++ drops code signing for its releases • Hacker News Board

Re: Notepad++ drops code signing for its releases

#161

Post by GordonS » Thu, Mar 07, 2019, 6:52 PM UTC

burtonator wrote: post #146

I created a huge rant on code signing certificates here: https://www.youtube.com/watch?v=mwuk0E-tfeg It's a nightmare. Complete scam. I needed this for Polar: https://getpolarized.io/ Mind you... it's Open Source but I still want my users to be able to download it without warnings. No joke - it took me 2 weeks to get the CSC with about 4 hours per day working on just this CSC issue. It's just a labyrinth of insanity…

Not sure how it managed to take you so long, but I do agree it's a PITA, and pure theatre.

I did need to get into D&B, and it was a bit of a faff - their website is a maze, and it took around a week after filling the form to get listed. Didn't need much time on it though.

One of the other requirements I had to fulfil was having a telephone number published in a sanctioned list of websites for a callback - so I registered a Skype number, published the number, did the callback, and terminated the number. Not sure what that was meant to prove...

Re: Notepad++ drops code signing for its releases

#162

Post by Spivak » Thu, Mar 07, 2019, 6:53 PM UTC

ars wrote: post #68

cm2187 wrote: post #62

Earlier quoted context omitted.

How would let's encrypt verify the identity of the author?

They could sign an email address instead of a name.

Why bother with an email address? You could just punt the identity verification to the domain registrars and sign the domain.

I don't really think this scheme would benefit the end user though.

Re: Notepad++ drops code signing for its releases

#163

Post by NullPrefix » Thu, Mar 07, 2019, 6:53 PM UTC

1wd wrote: post #57

criddell wrote: post #16

Earlier quoted context omitted.

Why bother checking the signature of dependencies if the main executable integrity isn't being checked? What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.

The opposite would surprise me. How would Notepad++ earn any money?

Context aware ads

Re: Notepad++ drops code signing for its releases

#164

Post by russdpale » Thu, Mar 07, 2019, 6:54 PM UTC

wozer wrote: post #116

In Germany, Notepad++ is ubiquitous on Windows computers (every developer has it). Is it like this in the US, too?

In my experience, npp has been surpassed by vscode or atom. however, I have recently found the markdown npp plugin and because of npp's speed, its become my go to markdown editor/viewer.

If I need to just edit one file quickly with a simple change, npp is still my go to.

Re: Notepad++ drops code signing for its releases

#165

Post by NullPrefix » Thu, Mar 07, 2019, 6:55 PM UTC

juliusmusseau wrote: post #104

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

>Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't.

I don't trust poor people either. Bigger chance that they're scaming .... because they need the money.

Re: Notepad++ drops code signing for its releases

#166

Post by mikewhy » Thu, Mar 07, 2019, 6:58 PM UTC

SmellyGeekBoy wrote: post #72

daveFNbuck wrote: post #15

Earlier quoted context omitted.

The author is saying that signing certificates are something that FOSS authors enjoy using, but they have no practical purpose outside of that enjoyment.

I don't know, getting rid of the huge "YOU MAY BE INSTALLING DANGEROUS SOFTWARE" warning in Windows 10 seems like a practical purpose.

For that you need to shell out even more for an EV Cert. If you just have a regular cert, people are still warned when running your app.

Re: Notepad++ drops code signing for its releases

#167

Post by CamperBob2 » Thu, Mar 07, 2019, 6:59 PM UTC

0815test wrote: post #117

hota_mazi wrote: post #58

Earlier quoted context omitted.

Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.

If your compiler correctly enforces security properties (and many languages do attempt to do this, at least in well-defined "safe" subsets), then of course any source code compiled with it is going to be safe. It's the difference between the JavaScript/WASM JIT-powered sandbox on the one hand, and the ActiveX code-signing-based model on the other. Which is safer?

What? A compiler can't tell if a given program is "safe" any more than it can tell if the program will halt.

Re: Notepad++ drops code signing for its releases

#168

Post by gruez » Thu, Mar 07, 2019, 6:59 PM UTC

jacekm wrote: post #148

gruez wrote: post #2

Why not use something like certum[1]? It's $69/year (cheaper if you already have a smartcard), but the CN ends up with something like "Open source developer, [full name]". It's not "notepad++" like the author wants, but it's still better than nothing. [1] https://en.sklep.certum.pl/data-safety/code-signing-certific... edit: updated price

They've already tried it https://twitter.com/Notepad_plus/status/1098519332852822016

If you read further down (https://twitter.com/Notepad_plus/status/1098553736656572416), you find out it's because certum didn't allow them to use "notepad++" as the CN (probably because it's not a valid legal entity).

Re: Notepad++ drops code signing for its releases

#169

Post by Leace » Thu, Mar 07, 2019, 7:05 PM UTC

kazinator wrote: post #155

juliusmusseau wrote: post #104

Earlier quoted context omitted.

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

Your trust is misplaced; a developer who drops $$$ on a certificate could be a dyed-in-the-wool criminal. Just because code is signed and certified doesn't mean it doesn't do anything bad. Signing and certificates revolve around trust/mistrust in the delivery channel not in the purveyor. That problem can be solved with other tools, like PGP. You don't have to be blackmailed by a platform's certificate racket.

> That problem can be solved with other tools, like PGP. You don't have to be blackmailed by a platform's certificate racket.

It kind of works that way in Linux world where artifacts are PGP signed and to get your key into distro store one has to have "reputation". With the caveat that different distros have different schemes.

X.509 used by Windows has two nice properties that PGP doesn't - certificate attestation (MS can be sure your private key is on a hardware token) and timestamping (even if the cert expires if the signature has a timestamp it's still valid).

Re: Notepad++ drops code signing for its releases

#170

Post by close04 » Thu, Mar 07, 2019, 7:06 PM UTC

k32sic wrote: post #149

close04 wrote: post #49

Earlier quoted context omitted.

> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. With attacks getting more and more sophisticated just downloading from the legitimate site no longer guarantees integrity. Sometimes not even having the exe signed does it, with supply chain attacks and code injected long before being signed. Perhaps also posting the hash on a publ…

I will always put more trust to downloads form web sites that have an owner, than apps coming from an app store. It is very easy to put my trust in an app when I see the amount of work has been put in setting up a site (documentation, history of development, etc). The app stores do not offer any kind of information that would help to put my trust in the developer and application. Certifactes are a fallacy that tell n…

> I will always put more trust to downloads form web sites that have an owner, than apps coming from an app store.

The article is about signing the Windows binary that you download from the developer's site so when the UAC dialog pops up on installation it shows a valid publisher. Nothing to do with an app store.

> The app stores

Again, different topic.

> Certifactes are a fallacy that tell nothing about the security of the app.

Actually they do. It's a 0 effort way for the user to tell that the installer was not modified between compilation and installation. How do you tell that the developer's site wasn't hacked and the installer doesn't have some bundled malware?

> Also why do all security experts want to shove their security agenda to the world ?

Because that 1 million computer botnet attacking your site may just be made up of a lot of people who don't know what certificates are for, how to check if a download is legit, etc.