Notepad++ drops code signing for its releases • Hacker News Board

Re: Notepad++ drops code signing for its releases

#241

Post by fjabre » Thu, Mar 07, 2019, 9:53 PM UTC

sephoric wrote: post #65

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

The days of custom software are over in general. Every major niche has at least one major player that offers its services for free, selling your data (or ads, etc) in exchange. I'm not sure Sublime Text gets any money anymore now that VS Code does all the same things and more. Custom music players have been dead since Winamp 3. The 1990s and 2000s were like the Wild West for software, now it's like California, fully…

This is the problem as youve highlighted.

We must now contend with these power brokers and ask their permission for every install.

Re: Notepad++ drops code signing for its releases

#242

Post by fjabre » Thu, Mar 07, 2019, 9:55 PM UTC

armandososa wrote: post #71

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

Ah the good old days when nobody except the experts cared to buy, never mind install, third party software.

We made it work and didnt have to ask IBMs permission to install software on its devices.

Re: Notepad++ drops code signing for its releases

#243

Post by forgery-- » Thu, Mar 07, 2019, 10:25 PM UTC

Companies using Carbon Black Protection (Bit9) or similar application whitelisting systems use signing certificates to help approve software. Once I approve the "Simon Tatham" certificate for my company, anyone can download the latest version of PuTTY and run it without issue. I wish the trend was for more software to be signed.

Re: Notepad++ drops code signing for its releases

#244

Post by rando444 » Thu, Mar 07, 2019, 10:32 PM UTC

msla wrote: post #114

juliusmusseau wrote: post #104

Earlier quoted context omitted.

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

> Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Why? If I expect to make four figures on spreading malware/adware, and I can assuage the nerves of people like you by spending two or three figures on a certificate, I'm going to buy the certificate and make it look all nice and pretty and take your money. >…

The part you're missing is that your delaware company burner phone certificate investments can be invalidated in two seconds by the certificate's trust getting revoked.

Re: Notepad++ drops code signing for its releases

#245

Post by xkcd-sucks » Thu, Mar 07, 2019, 10:38 PM UTC

juliusmusseau wrote: post #104

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

When we were getting EV certs from Digicert, somebody called up the office to confirm the name of the CEO. He answered the phone and the person told him he couldn't validate his own identity. So he passed the phone to the person sitting next to him, she said "Oh yeah this totally him sitting next to me" and we got our EV cert within the hour.

Re: Notepad++ drops code signing for its releases

#246

Post by iforgotpassword » Thu, Mar 07, 2019, 10:41 PM UTC

juliusmusseau wrote: post #104

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

To me it's rather the opposite. Especially for open source software. Spend your time, money and energy on improving the actual product instead of wasting it on smoke and mirrors.

Re: Notepad++ drops code signing for its releases

#247

Post by [deleted] » Thu, Mar 07, 2019, 10:59 PM UTC

kazinator wrote: post #186

close04 wrote: post #179

Earlier quoted context omitted.

The advantage of a certificate is that it's 0 effort for the regular user. Every additional layer of "work" someone has to do to check that integrity just lowers the efficiency. I suggested the disseminated hash method because it would work but most users won't bother checking it. Add blockchain in that and you've lost them completely. Unless you have a 1-click way of checking, something built into the OS ideally, it…

> most users won't bother checking it That's also zero effort, though. I don't care if users aren't checking; I published the hash, so I'm covered. I am not liable for the behavior of random materials, even if they happen to be tampered versions of something I produced. Even if you make a signed and certified installer, someone can turn it into a malicious unsigned one and people will install anyway. They will click…

[deleted]

Re: Notepad++ drops code signing for its releases

#248

Post by flukus » Thu, Mar 07, 2019, 11:00 PM UTC

juliusmusseau wrote: post #104

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

> Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20.

Ever notice how most con-men wear nice suits? Your advocating for the digital equivalent.

Re: Notepad++ drops code signing for its releases

#249

Post by Godel_unicode » Thu, Mar 07, 2019, 11:01 PM UTC

rando444 wrote: post #244

msla wrote: post #114

Earlier quoted context omitted.

> Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Why? If I expect to make four figures on spreading malware/adware, and I can assuage the nerves of people like you by spending two or three figures on a certificate, I'm going to buy the certificate and make it look all nice and pretty and take your money. >…

The part you're missing is that your delaware company burner phone certificate investments can be invalidated in two seconds by the certificate's trust getting revoked.

The part you're missing is that they won't be in practice. There's malware on virustotal with (still) valid code-signing certs.

Re: Notepad++ drops code signing for its releases

#250

Post by close04 » Thu, Mar 07, 2019, 11:02 PM UTC

kazinator wrote: post #186

close04 wrote: post #179

Earlier quoted context omitted.

The advantage of a certificate is that it's 0 effort for the regular user. Every additional layer of "work" someone has to do to check that integrity just lowers the efficiency. I suggested the disseminated hash method because it would work but most users won't bother checking it. Add blockchain in that and you've lost them completely. Unless you have a 1-click way of checking, something built into the OS ideally, it…

> most users won't bother checking it That's also zero effort, though. I don't care if users aren't checking; I published the hash, so I'm covered. I am not liable for the behavior of random materials, even if they happen to be tampered versions of something I produced. Even if you make a signed and certified installer, someone can turn it into a malicious unsigned one and people will install anyway. They will click…

Here's an example of how the signature can help a user [0]. If fewer people fall for it that's still a win.

Your argument is that if a mechanism isn't perfect we shouldn't be using it at all. Well seatbelts and airbags also don't guarantee anything but still save people. Security is additive, no layer is perfect but put enough of them together and you can be relatively safe.

[0] https://arstechnica.com/information-technology/2015/05/sourc...