Notepad++ drops code signing for its releases • Hacker News Board

Re: Notepad++ drops code signing for its releases

#201

Post by gruez » Thu, Mar 07, 2019, 8:14 PM UTC

1wd wrote: post #67

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

Also code signing doesn't automatically lead to the "blue-trusted UAC popup" anymore anyway.

You're conflating the UAC prompt with the smartscreen popup. see: https://news.ycombinator.com/item?id=19330901

Re: Notepad++ drops code signing for its releases

#202

Post by vbezhenar » Thu, Mar 07, 2019, 8:15 PM UTC

ars wrote: post #68

cm2187 wrote: post #62

Earlier quoted context omitted.

How would let's encrypt verify the identity of the author?

They could sign an email address instead of a name.

Or just show domain. I think that notepad-plus-plus.org is good enough as an identifier.

Re: Notepad++ drops code signing for its releases

#203

Post by Leace » Thu, Mar 07, 2019, 8:15 PM UTC

g45y45 wrote: post #191

Leace wrote: post #169

Earlier quoted context omitted.

> That problem can be solved with other tools, like PGP. You don't have to be blackmailed by a platform's certificate racket. It kind of works that way in Linux world where artifacts are PGP signed and to get your key into distro store one has to have "reputation". With the caveat that different distros have different schemes. X.509 used by Windows has two nice properties that PGP doesn't - certificate attestation (M…

Kinda. You can use mimikatz to override the checks that the private key is isolated, you can even override 'no export' flag. Timestamping relies on external trusted timestamp providers implementing RFC 3161. There are many out there, maybe you could get a false timestamp out of them. I agree could be stronger than PGP, however it suffers a design flaw in that it considers the geometry of the PE file. PGP signs the wh…

> You can use mimikatz to override the checks that the private key is isolated, you can even override 'no export' flag.

"No export" flag is not the same. What I'm talking about is keys stored in hardware modules (TPM, Yubikey) so that the private key is never disclosed, you can only ask the hardware to perform actions using that key.

See for example Yubikey docs: https://developers.yubico.com/PIV/Introduction/PIV_attestati...

> There are many out there, maybe you could get a false timestamp out of them.

Maybe? That's how CA model works, they are trusted third parties. Code signing CAs are required to operate timestamping services so it getting a cert from them is not a security issue, timestamping should also be fine.

PGP on the other hand if used in a Web of Trust model makes every valid key a CA. Not to mention that PGP doesn't have extended key usage flags so signing software is the same as signing e-mail (you cannot specify that you want to have this key be used for code signing exclusively).

Re: Notepad++ drops code signing for its releases

#204

Post by vbezhenar » Thu, Mar 07, 2019, 8:16 PM UTC

Spivak wrote: post #162

ars wrote: post #68

Earlier quoted context omitted.

They could sign an email address instead of a name.

Why bother with an email address? You could just punt the identity verification to the domain registrars and sign the domain. I don't really think this scheme would benefit the end user though.

I would prefer notepad-plus-plus.org rather than some vague "Notepad, LLC", registered somewhere in the world.

Re: Notepad++ drops code signing for its releases

#205

Post by lucb1e » Thu, Mar 07, 2019, 8:16 PM UTC

jimktrains2 wrote: post #5

> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors. I'm not sure what the author means by this.

I don't get it either. If you replace the word "FOSS authors" with "big corporations", then sure. But specifically FOSS authors are the kind of people that don't ask money for it -- all of Debian (thousands of software packages just like Notepad++) are signed, but nobody is paying anyone a penny for it...

I really don't get how a FOSS author blames FOSS authors?! The problem is clearly with Microsoft and many FOSS authors don't bother and just sign it with their own, web-of-trust'ed PGP keys.

Re: Notepad++ drops code signing for its releases

#206

Post by ozim » Thu, Mar 07, 2019, 8:17 PM UTC

juliusmusseau wrote: post #104

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

You know our whole civilization is based on $$$ == trust. Just wait until you lend money to someone who is going to remind you every month he will pay you back because he is a good person, but you never see the money.

Re: Notepad++ drops code signing for its releases

#207

Post by Leace » Thu, Mar 07, 2019, 8:20 PM UTC

msla wrote: post #200

Leace wrote: post #169

Earlier quoted context omitted.

> That problem can be solved with other tools, like PGP. You don't have to be blackmailed by a platform's certificate racket. It kind of works that way in Linux world where artifacts are PGP signed and to get your key into distro store one has to have "reputation". With the caveat that different distros have different schemes. X.509 used by Windows has two nice properties that PGP doesn't - certificate attestation (M…

> It kind of works that way in Linux world where artifacts are PGP signed and to get your key into distro store one has to have "reputation". With the caveat that different distros have different schemes. ... none of them financial. I'm not saying that financial incentives are bad, necessarily, but I am saying that being able/forced to buy your way in privileges the most organized scammers, the ones who have a cogent…

> I am saying that being able/forced to buy your way in privileges the most organized scammers

This works both ways because legitimate software developers also don't have easy ways of pushing their signed software to end users. Usually step 1 in installing software from external developer is "get my PGP key imported" [0].

[0]: https://www.sublimemerge.com/docs/linux_repositories

I don't mean Linux distro's model is worse or that Windows model is better. What I mean is that none of them is significantly better than the other. Just different with different trade-offs.

Re: Notepad++ drops code signing for its releases

#208

Post by OldSchoolJohnny » Thu, Mar 07, 2019, 8:20 PM UTC

NullPrefix wrote: post #165

juliusmusseau wrote: post #104

Earlier quoted context omitted.

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

>Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. I don't trust poor people either. Bigger chance that they're scaming .... because they need the money.

Wow.

Re: Notepad++ drops code signing for its releases

#209

Post by diminoten » Thu, Mar 07, 2019, 8:21 PM UTC

duxup wrote: post #25

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

> Is there any evidence that was ever really a thing / effective?

Of course not, the person who wrote that has absolutely no concept of the modern Internet user, and probably thinks themselves materially better than them.

Re: Notepad++ drops code signing for its releases

#210

Post by freedman1611 » Thu, Mar 07, 2019, 8:21 PM UTC

Reading these comments makes me so happy to be a Linux/BSD user. The hoops you guys have to jump through in proprietary land. Wow, pay $$$ to be treated like shit. It's kinda like those guys that hire a dominatrix to belittle them and make them lick her heel, yet they get off on it.