other than Microsofts signed software, the fact it is signed doesn't really mean much to me as I have no idea what anything should be signed with. What I tend to trust is that I know specifically where I went to get a piece of software. It is easier for me to tell what an official site is rather than an official signature
Notepad++ drops code signing for its releases
231–240 of 335 posts
Re: Notepad++ drops code signing for its releases
#232I'm on the same track.
Definitely we need Let's Encrypt for code signing certificates!
Re: Notepad++ drops code signing for its releases
#233Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php
Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…
> I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't.
This is a misapplication of Bayes theorem.
P(bad) is the probability any app is bad
P(signed) is the probability any app is signed
P(bad if signed) = P(signed if bad) * P(bad) / P(signed)
Malware authors have incentive to make their apps appear legitimate, either by stealing keys, impersonating companies, or other mechanisms. Signing also helps get past automated checks (per the paper above).
Further, those probabilities assume random distribution, but I'd suggest that really expensive/dangerous malware has greater incentives to appear safe, so it is even more likely to be signed, even if most malware is not. Stuxnet would be a case in point - high value, sophisticated malware, signed.
P(really bad if signed) = P(signed if really bad) * P(really bad) / P(signed)
P(really bad) is lower,
but P(signed if really bad) approaches 1,
so P(really bad if signed) approaches P(really bad)
Re: Notepad++ drops code signing for its releases
#234In case anyone reads this far down:
https://docs.microsoft.com/en-us/windows-hardware/drivers/da...
Follow the steps under “Buy a DigiCert EV code signing certificate“.
You’re welcome. ;)
Re: Notepad++ drops code signing for its releases
#235Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php
Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…
> I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't.
Why?
> you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public directory (e.g., bbb.org), and someone representing your business needs to pick up that phone when the cert validator calls it.
So you only trust code that comes from businesses?
Re: Notepad++ drops code signing for its releases
#236Earlier quoted context omitted.
That's incorrect. All code authenticode signing certificates (trusted by microsoft) turns the UAC prompt from yellow to blue. EV certificates is probably for auto-trust for smartscreen.
Only after you noticed that UAC color is blue instead of yellow i started to see difference. No user will understand this though.
Up until reading this thread I wasn't even aware that there were different UAC colours.
Re: Notepad++ drops code signing for its releases
#237Earlier quoted context omitted.
> I am saying that being able/forced to buy your way in privileges the most organized scammers This works both ways because legitimate software developers also don't have easy ways of pushing their signed software to end users. Usually step 1 in installing software from external developer is "get my PGP key imported" [0]. [0]: https://www.sublimemerge.com/docs/linux_repositories I don't mean Linux distro's model is w…
> Usually step 1 in installing software from external developer is "get my PGP key imported" [0]. Even #%@! Oracle does it: https://www.virtualbox.org/wiki/Linux_Downloads I wonder what’s the point of the PGP key then.
> I wonder what’s the point of the PGP key then.
Trust on First Use. Once the key is imported it stays the same.
People working for that organization can sign the key to attest it's real (Web of Trust). Although I wonder how would they check it. Organization (non-individual) keys are weird because ultimately it's just an individual behind it.
Re: Notepad++ drops code signing for its releases
#238I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…
When were those days? I remember that 99/100 users didn’t think before installing a free screensaver and got hit with some kind of malware. While I disagree with how centralized this practice is I’m applauding that an effort is being made to keep malware off consumer devices. What we need is a decentralized and self policing ecosystem. A Wikipedia of validation. Something that’s truly monumenta to pull together. I un…
Centralized their efforts at our expense. They work for their shareholders.
Re: Notepad++ drops code signing for its releases
#239I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…
Those days never existed. Which is why certs, app stores, and walled gardens exist.
Pretty soon thats all that will exist.
Re: Notepad++ drops code signing for its releases
#240I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…
> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe
This.
The sad thing is that this is still as important to do as it ever was -- but fewer people do it.