Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

Post reply on HN
Print view View original

251–260 of 335 posts

Re: Notepad++ drops code signing for its releases

#251

Post by Godel_unicode »

Twisell wrote: post #139
Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Wait are you saying that Apple Developer program for 99$/year is actually quite a good deal in comparison? I will definitely pull this thread out next time someone complain that Apple is too expensive and that they are milking the poor developers...

You can deliver unsigned Windows apps.

Re: Notepad++ drops code signing for its releases

#252

Post by cm2187 »

tomc1985 wrote: post #176
cm2187 wrote: post #62

Earlier quoted context omitted.

How would let's encrypt verify the identity of the author?

Why must identity be an essential part? It's just a private key.

The key has no value if anyone can sign the binaries in the name of the developper. Then the binaries might as well not be signed.

Re: Notepad++ drops code signing for its releases

#253

Post by godzillabrennus »

fjabre wrote: post #238
godzillabrennus wrote: post #91

Earlier quoted context omitted.

When were those days? I remember that 99/100 users didn’t think before installing a free screensaver and got hit with some kind of malware. While I disagree with how centralized this practice is I’m applauding that an effort is being made to keep malware off consumer devices. What we need is a decentralized and self policing ecosystem. A Wikipedia of validation. Something that’s truly monumenta to pull together. I un…

Centralized their efforts at our expense. They work for their shareholders.

Buy shares. Become a shareholder.

These are public entities.

Re: Notepad++ drops code signing for its releases

#254

Post by Faark »

throwawaymath wrote: post #66
duxup wrote: post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

> absurd advice that security experts put out about "only download something you trust" This is mostly a meme from the overzealous FOSS and privacy crowd, not the security crowd. Professional security engineers do not, as a rule, encourage software engineers (or end users more generally) to only use open source software because "you can inspect the code for vulnerabilities." Anyone with legitimate security expertise…

> Professional security engineers do not, as a rule, encourage software engineers [..] to only use open source software because "you can inspect the code for vulnerabilities."

All else being equal, I'd certainly have more trust in the FOSS version. Yes, i won't audit it myself, but source we can compile ourself is still easier to audit. As such I'd hope more people will have eyes on it than without source access.

Same for a hash of the executable I download being generated by an reproducible build. And I prefer to download and run the same installer as everyone else than someone offering a custom download link just for me.

Non of that means I don't have to trust the project/maintainer. But it is a bit of extra safety I want in some cases, e.g. for a password manager.

Re: Notepad++ drops code signing for its releases

#255

Post by eridius »

Godel_unicode wrote: post #251
Twisell wrote: post #139

Earlier quoted context omitted.

Wait are you saying that Apple Developer program for 99$/year is actually quite a good deal in comparison? I will definitely pull this thread out next time someone complain that Apple is too expensive and that they are milking the poor developers...

You can deliver unsigned Windows apps.

You can deliver unsigned Mac apps too, just not on the MAS.

Re: Notepad++ drops code signing for its releases

#256

Post by cat199 »

throwawaymath wrote: post #66
duxup wrote: post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

> absurd advice that security experts put out about "only download something you trust" This is mostly a meme from the overzealous FOSS and privacy crowd, not the security crowd. Professional security engineers do not, as a rule, encourage software engineers (or end users more generally) to only use open source software because "you can inspect the code for vulnerabilities." Anyone with legitimate security expertise…

> Professional security engineers do not, as a rule, encourage software engineers (or end users more generally) to...

And many 'professional security engineers' ignore core security (e.g. auditing protocols, connections, user access, etc) to push AV software, 2fa tokens, NIDS, version/patchlevel compliance infrastructure, and other 'security tools', because this is easier and comes with 'vendor support'.

I don't argue that these tools are a 'meme' however simply because there are a few people that don't understand the whole picture.

I could just as easily argue:

"The idea that most people can reliably identify security vulnerabilities in the systems they use just because it's protected by vulnerability scanning tools is laughable. They might find trivial low hanging fruit or obvious malicious activity, but they won't have a better picture of the overall security posture just because they can read the audit report."

Re: Notepad++ drops code signing for its releases

#257

Post by sgc »

moonshinefe wrote: post #183
Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

I have to say I agree here. Notepad++ if it provides hashes for the downloaded EXEs is completely in the right for not wanting to pay middle men for fancy "this is OK" screen on installation. That seems ridiculous and greedy.

Especially for a program that caters to developers. People will understand.

Re: Notepad++ drops code signing for its releases

#259

Post by pornel »

gruez wrote: post #2

Why not use something like certum[1]? It's $69/year (cheaper if you already have a smartcard), but the CN ends up with something like "Open source developer, [full name]". It's not "notepad++" like the author wants, but it's still better than nothing. [1] https://en.sklep.certum.pl/data-safety/code-signing-certific... edit: updated price

It's nice they support FOSS, but both the CA process and Microsoft's tooling for this are stuck in the year 1999:

• The registration process is painfully manual (including e-mailing scanned documents). It's like an "Enterprise" CA from before Let's Encrypt.

• The website wouldn't send the final cert to any browser other than Internet Explorer.

• Microsoft's signing tools are a hot garbage. All options default to "subtly wrong". To get a working signature you need a half dozen flags in an exact order, different from what the official documentation uses.

• Microsoft's docs are either: a) plentiful but only tangentially related vague introduction, or b) scraps of incomplete technical information, mainly for Windows XP only. It's as if they've tried to improve it many times, but every time gave up after rewriting the first chapter.

• Signing can't be automated or used remotely, because its weirdo software wants a PIN entered from the local keyboard.

Post reply on HN