Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

Post reply on HN
Print view View original

261–270 of 335 posts

Re: Notepad++ drops code signing for its releases

#261

Post by craftyguy »

hota_mazi wrote: post #58
duxup wrote: post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.

> if you can download a source and build the program yourself, then it's safe.

I think only a loud (very small) minority think that. The rest of us know that's silly, and bringing it up to prove some point against "FOSS zealots" is also silly. FOSS does allow for independent code reviews (which do happen on some projects), but that's not the only reason FOSS > proprietary crap.

Re: Notepad++ drops code signing for its releases

#262

Post by xpaulbettsx »

At the end of the day, Notepad++ can't get a "Notepad++" cert because "Notepad++" is not a Legal Entity (i.e. a corporation or living person). At least from a policy perspective, Microsoft will only consider Legal Entities to be valid code signatories.

Yes, this is stupid and outdated, I agree - I personally think that Keybase issuing code signing certificates and being able to verify that the person who signed this also owns this GitHub and that Twitter account would still be super valuable.

Re: Notepad++ drops code signing for its releases

#263

Post by marcosdumay »

kbutler wrote: post #233
juliusmusseau wrote: post #104

Earlier quoted context omitted.

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

> I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. This is a misapplication of Bayes theorem. P(bad) is the probability any app is bad P(signed) is the probability any app is signed P(bad if signed) = P(signed if bad) * P(bad) / P(signed) Essentially your trust model requires that "the fraction of bad apps that are signed is small", or P(signed if bad) ap…

All the GP is saying is that he believes that P(signed if bad) It's a fair belief because paying for something leaves a paper trail. MS certificates are a farce at $500/year, but Google's $20 once is a very reasonable thing.

Your point that really bad malware has higher odds of being signed is a good one, but really bad malware is much less likely than simply "malware".

Re: Notepad++ drops code signing for its releases

#264

Post by arunc »

These kind of code-signing certificates should be free for free and open source projects.

D Language community recently [1][2] bought a certificate reluctantly to satisfy Windows defender, virus scan warning, etc. Sadly we are stuck with this immoral blackmails.

[1] https://forum.dlang.org/post/sclqnbggytmyetwrxppb@forum.dlan...

[2]https://dlang.org/changelog/2.082.0.html#signed_windows_bina...

Re: Notepad++ drops code signing for its releases

#265

Post by jimktrains2 »

daveFNbuck wrote: post #15
jimktrains2 wrote: post #5

> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors. I'm not sure what the author means by this.

The author is saying that signing certificates are something that FOSS authors enjoy using, but they have no practical purpose outside of that enjoyment.

I guess I haven't used systems with code signing like this. Is it really that common?

Re: Notepad++ drops code signing for its releases

#266

Post by iamaelephant »

duxup wrote: post #25
fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

> Is there any evidence that was ever really a thing

Are you asking if software existed before code signing? Yes, it did.

Re: Notepad++ drops code signing for its releases

#268

Post by randyrand »

iamaelephant wrote: post #266
duxup wrote: post #25

Earlier quoted context omitted.

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security exper…

> Is there any evidence that was ever really a thing Are you asking if software existed before code signing? Yes, it did.

HN has a guideline that you should respond to the best interpretation of a comment, not the least favorable one.

IMO he was clearly reffering to 'thing' being 'an effective thing' for preventing viruses, as opposed to him asking if people downloaded software before code signing.

Re: Notepad++ drops code signing for its releases

#269

Post by kbutler »

marcosdumay wrote: post #263
kbutler wrote: post #233

Earlier quoted context omitted.

> I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. This is a misapplication of Bayes theorem. P(bad) is the probability any app is bad P(signed) is the probability any app is signed P(bad if signed) = P(signed if bad) * P(bad) / P(signed) Essentially your trust model requires that "the fraction of bad apps that are signed is small", or P(signed if bad) ap…

All the GP is saying is that he believes that P(signed if bad) It's a fair belief because paying for something leaves a paper trail. MS certificates are a farce at $500/year, but Google's $20 once is a very reasonable thing. Your point that really bad malware has higher odds of being signed is a good one, but really bad malware is much less likely than simply "malware".

I believe he's saying P(bad if signed) When the Transmission bittorrent client site was hacked to distribute ransomware, it was signed using an unrelated certificate that was likely stolen. This happened twice within a year, with different valid (stolen) certificates:

https://blog.malwarebytes.com/threat-analysis/2016/09/transm...

Stuxnet certificates were also stolen.

This disproves the GGP's premise that a signed app implies the developer paid for it, as well as your assumption that the paper trail for legally acquiring a certificate is an impediment to signing malware.

You're not only trusting the developer who purchased the certificate and the CA that granted the certificate, but also trusting the ongoing security of everybody else who has purchased a trusted certificate. That's a pretty open circle of trust.

Certificate revocation can limit the time of exposure once malware is distributed, but it isn't always implemented.

https://arstechnica.com/information-technology/2017/11/evasi...

"they found 189 malware samples bearing valid digital signatures that were created using compromised certificates issued by recognized certificate authorities and used to sign legitimate software. In total, 109 of those abused certificates remain valid."

Re: Notepad++ drops code signing for its releases

#270

Post by exodust »

crispyambulance wrote: post #192

Does this mean that some users won't be allowed to install Notepad++ because it's not signed? I know some corporate environments have restrictions on downloaded installers. Off topic, but I have to say that whenever I need to open hundreds of files at once and perform regex operations-- this editor rocks that task like no other. Kudos to Notepad++

You might be right, although developers usually have local admin rights, so it should be a matter of clicking past the warnings.
Post reply on HN