Notepad++ drops code signing for its releases • Hacker News Board

Re: Notepad++ drops code signing for its releases

#181

Post by ghostly_s » Thu, Mar 07, 2019, 7:18 PM UTC

theandrewbailey wrote: post #118

gambler wrote: post #84

Earlier quoted context omitted.

LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with encryption, so having analogous CA for code would be entirely meaningless. What does code signing in Windows actually verify? That executable's author at some point paid money to some company that Microsoft deemed an "authority"? It's a rotten system. The whole C…

> LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Have you used Let's Encrypt? It verifies that you own the domain in question. HTTPS requires that the server you're connecting to has been identified.

Verifying domain control =/= verifying identity.

Re: Notepad++ drops code signing for its releases

#182

Post by juliusmusseau » Thu, Mar 07, 2019, 7:21 PM UTC

burtonator wrote: post #146

I created a huge rant on code signing certificates here: https://www.youtube.com/watch?v=mwuk0E-tfeg It's a nightmare. Complete scam. I needed this for Polar: https://getpolarized.io/ Mind you... it's Open Source but I still want my users to be able to download it without warnings. No joke - it took me 2 weeks to get the CSC with about 4 hours per day working on just this CSC issue. It's just a labyrinth of insanity…

For those that don't know, D&B stands for Dun & Bradstreet (https://www.dnb.com/). They have this concept of a D-U-N-S Number which basically means information about your business is in their database.

Last I checked expedited D&B was around $40 USD (10 business days) and same-day D&B around $500 USD.

Free D&B said it would take 30 business days, but it actually only took them 5 business days when I applied for it.

Re: Notepad++ drops code signing for its releases

#183

Post by moonshinefe » Thu, Mar 07, 2019, 7:22 PM UTC

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

I have to say I agree here. Notepad++ if it provides hashes for the downloaded EXEs is completely in the right for not wanting to pay middle men for fancy "this is OK" screen on installation. That seems ridiculous and greedy.

Re: Notepad++ drops code signing for its releases

#184

Post by Leace » Thu, Mar 07, 2019, 7:24 PM UTC

gruez wrote: post #159

ex3ndr wrote: post #133

Earlier quoted context omitted.

This certificate doesn't help to bypass UAC and "unsecure" prompt still be shown to the user.

That's incorrect. All code authenticode signing certificates (trusted by microsoft) turns the UAC prompt from yellow to blue. EV certificates is probably for auto-trust for smartscreen.

> EV certificates is probably for auto-trust for smartscreen.

Yes, that's correct. EV just skips the reputation building phase.

Source: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...

> Programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher.

Re: Notepad++ drops code signing for its releases

#185

Post by richrichardsson » Thu, Mar 07, 2019, 7:25 PM UTC

imhoguy wrote: post #60

richrichardsson wrote: post #51

Earlier quoted context omitted.

To do that you need to provide some sort of notarised letter, so that adds more cost to the certificate.

Isn't national ID or passport enough for natural person in EU to obtain a qualified certificate?

The whole process is fairly opaque, I wish they would be a bit more transparent about what is involved. I found this : https://www.thesslstore.com/thawte/code-signing-individual.a...

> During the validation process, Thawte requires you to present a notarized form that validates some sort of government issued photo identification and take a quick phone call. Don't worry though, this process is easy and we'll provide you with an easy-to-read validation guide after purchase.

Why can't they provide the guide ahead of purchase is ridiculous.

Re: Notepad++ drops code signing for its releases

#186

Post by kazinator » Thu, Mar 07, 2019, 7:33 PM UTC

close04 wrote: post #179

kazinator wrote: post #160

Earlier quoted context omitted.

Yes, simple hashes that are widely disseminated solve the problem from a practical point of view. Someone tampering with a binary executable or installer cannot alter all of the copies of the hash. A blockchain could be used for that. When you publish something, take its hash, and the add it to a public ledger.

The advantage of a certificate is that it's 0 effort for the regular user. Every additional layer of "work" someone has to do to check that integrity just lowers the efficiency. I suggested the disseminated hash method because it would work but most users won't bother checking it. Add blockchain in that and you've lost them completely. Unless you have a 1-click way of checking, something built into the OS ideally, it…

> most users won't bother checking it

That's also zero effort, though.

I don't care if users aren't checking; I published the hash, so I'm covered. I am not liable for the behavior of random materials, even if they happen to be tampered versions of something I produced.

Even if you make a signed and certified installer, someone can turn it into a malicious unsigned one and people will install anyway. They will click through the UAC and that's that.

There is no benefit in the signing when the genuine program is being installed; there is no attack going on that the signing is protecting against. It's supposed to stop a counterfeit program.

If the goal is zero effort on the part of the user, then the scheme is doomed. The zero-effort user takes no interest in signing; he or she doesn't wonder "how come this dialog is coming up", they just click through it.

Someone who counterfeits programs and adds malware can evne do one better: they can wrap the program in their own installer which has a valid certificate of their own.

The whole thing is a racket. You can't trust an artifact just because it was signed by someone whose only virtue was that they forked out $$$ for a certificate. Everyone has money, from heinous scoundrel to sparkling saint.

Re: Notepad++ drops code signing for its releases

#187

Post by Boulth » Thu, Mar 07, 2019, 7:34 PM UTC

GordonS wrote: post #156

Boulth wrote: post #153

Earlier quoted context omitted.

Thanks for taking the time to describe your experience. When you renewed the cert did you use the same key pair? (I'm wondering how does Microsoft correlate reputation).

No, it was a new key pair each time. I'm also rather interested to know how it decides reputation though!

Probably based on Subject name. It'd require a lot of money to verify that though (e.g. buying cert from another CA with the same name).

Re: Notepad++ drops code signing for its releases

#188

Post by juliusmusseau » Thu, Mar 07, 2019, 7:34 PM UTC

GordonS wrote: post #161

burtonator wrote: post #146

I created a huge rant on code signing certificates here: https://www.youtube.com/watch?v=mwuk0E-tfeg It's a nightmare. Complete scam. I needed this for Polar: https://getpolarized.io/ Mind you... it's Open Source but I still want my users to be able to download it without warnings. No joke - it took me 2 weeks to get the CSC with about 4 hours per day working on just this CSC issue. It's just a labyrinth of insanity…

Not sure how it managed to take you so long, but I do agree it's a PITA, and pure theatre. I did need to get into D&B, and it was a bit of a faff - their website is a maze, and it took around a week after filling the form to get listed. Didn't need much time on it though. One of the other requirements I had to fulfil was having a telephone number published in a sanctioned list of websites for a callback - so I regist…

There might be some risk to your business if a malicious person can get that number assigned to their phone since you're no longer using it.

Re: Notepad++ drops code signing for its releases

#189

Post by billforsternz » Thu, Mar 07, 2019, 7:39 PM UTC

I've been slowly improving my open source Windows chess program Tarrasch http://triplehappy.com for nearly 10 years. One of my improvement plans has been to put on my big boy pants, and spend the money and time needed to sign the program. I thought it was a big part of the program graduating and becoming a serious software citizen. After reading the comments here I am reconsidering and might save myself the pain. Thanks Hacker News!

Re: Notepad++ drops code signing for its releases

#190

Post by pvg » Thu, Mar 07, 2019, 7:39 PM UTC

landryraccoon wrote: post #177

smacktoward wrote: post #130

Earlier quoted context omitted.

They didn't say they trust the developer who spends the money absolutely , they said they trust the developer who spends the money more than they trust one who doesn't. Which is fair -- as you note, not every scammer will be scared off by the need to spend some money to pull the scam off; but some will, so the ratio of legitimate developers to illegitimate ones will be higher in markets where there's some cost to ent…

This is fallacious reasoning. A well intentioned open source developer who does not earn any money out of a labor of love has no incentive to further spend money to sign his app that he’s giving away for free anyway. On the flip side, a malicious actor that expects to earn money through a scam has every incentive to spend some money making the app look legit, especially if there is no risk involved.

The signed app can be globally disabled.