171–180 of 335 posts
Preferably one that does not require a USB dongle. Did order one from Comodo, but was not able to get the USB dongle to work.
Earlier quoted context omitted.
>OK I'll just buy an LLC When I bought code signing certificate for my LLC, in their infinite wisdom CA put "Spółka z ograniczoną odpowiedzialnością" as CN, because that's what they saw on proof of ownership. "Spółka z ograniczoną odpowiedzialnością" literally means "Limited liability company" in Polish.
I know that must have been a pain in the neck for you, but that's hilarious. Thanks for sharing!
Earlier quoted context omitted.
> Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Why? If I expect to make four figures on spreading malware/adware, and I can assuage the nerves of people like you by spending two or three figures on a certificate, I'm going to buy the certificate and make it look all nice and pretty and take your money. >…
They didn't say they trust the developer who spends the money absolutely , they said they trust the developer who spends the money more than they trust one who doesn't. Which is fair -- as you note, not every scammer will be scared off by the need to spend some money to pull the scam off; but some will, so the ratio of legitimate developers to illegitimate ones will be higher in markets where there's some cost to ent…
Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php
Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…
Earlier quoted context omitted.
If your compiler correctly enforces security properties (and many languages do attempt to do this, at least in well-defined "safe" subsets), then of course any source code compiled with it is going to be safe. It's the difference between the JavaScript/WASM JIT-powered sandbox on the one hand, and the ActiveX code-signing-based model on the other. Which is safer?
What? A compiler can't tell if a given program is "safe" any more than it can tell if the program will halt.
Earlier quoted context omitted.
> Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Why? If I expect to make four figures on spreading malware/adware, and I can assuage the nerves of people like you by spending two or three figures on a certificate, I'm going to buy the certificate and make it look all nice and pretty and take your money. >…
They didn't say they trust the developer who spends the money absolutely , they said they trust the developer who spends the money more than they trust one who doesn't. Which is fair -- as you note, not every scammer will be scared off by the need to spend some money to pull the scam off; but some will, so the ratio of legitimate developers to illegitimate ones will be higher in markets where there's some cost to ent…
Earlier quoted context omitted.
I don't know, getting rid of the huge "YOU MAY BE INSTALLING DANGEROUS SOFTWARE" warning in Windows 10 seems like a practical purpose.
For that you need to shell out even more for an EV Cert. If you just have a regular cert, people are still warned when running your app.
Earlier quoted context omitted.
> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. With attacks getting more and more sophisticated just downloading from the legitimate site no longer guarantees integrity. Sometimes not even having the exe signed does it, with supply chain attacks and code injected long before being signed. Perhaps also posting the hash on a publ…
Yes, simple hashes that are widely disseminated solve the problem from a practical point of view. Someone tampering with a binary executable or installer cannot alter all of the copies of the hash. A blockchain could be used for that. When you publish something, take its hash, and the add it to a public ledger.
I suggested the disseminated hash method because it would work but most users won't bother checking it. Add blockchain in that and you've lost them completely. Unless you have a 1-click way of checking, something built into the OS ideally, it will only be used by the more tech savvy users.
Feels like there's an opportunity for some kind organization to help open-source developers out with this. It shouldn't be this hard for someone trying to give away good work to the world. I used Notepad++ for a long time, and still might if I spent any time in Windows.
I wonder if Lets Encrypt is working on code-signing certs? That would be a huge win for FOSS