Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

Post reply on HN
Print view View original

281–290 of 335 posts

Re: Notepad++ drops code signing for its releases

#281

Post by royce »

I'm startled that there's no mention of app whitelisting yet.

Code signing reduces ops overhead and latency in environments that are using app whitelisting.

If the code is signed, then the signing certificate can be trusted once. All upgrades and patches that are signed with that certificate can be automatically whitelisted, with no intervention from teams managing the whitelisting.

But if the code isn't signed, then if even a single byte changes in the executable, it must be re-whitelisted - usually manually.

The more signed apps there are, the easier it is for companies to start using application whitelisting, the fewer people are needed to maintain it, and the faster patches to those applications can be deployed. Making it easier for companies to move to whitelisting increases security for the ecosystem in the aggregate.

Re: Notepad++ drops code signing for its releases

#282

Post by angry_octet »

pvg wrote: post #190
landryraccoon wrote: post #177

Earlier quoted context omitted.

This is fallacious reasoning. A well intentioned open source developer who does not earn any money out of a labor of love has no incentive to further spend money to sign his app that he’s giving away for free anyway. On the flip side, a malicious actor that expects to earn money through a scam has every incentive to spend some money making the app look legit, especially if there is no risk involved.

The signed app can be globally disabled.

This could be easily achieved by Microsoft running a free signing service. Lowering the cost of signing to zero would significantly increase the proportion of signed apps.

Re: Notepad++ drops code signing for its releases

#284

Post by tomc1985 »

cm2187 wrote: post #252
tomc1985 wrote: post #176

Earlier quoted context omitted.

Why must identity be an essential part? It's just a private key.

The key has no value if anyone can sign the binaries in the name of the developper. Then the binaries might as well not be signed.

Not really. The point of origin is the private key, which does need to be protected. Lack of identity verification might make key revocation/rotation more difficult, but identity is not really permanently coupled to the keypair. If that were true then why is the only thing stopping me from circulating self-signed certificates with bogus info the lack of a CA signature?

Re: Notepad++ drops code signing for its releases

#285

Post by angry_octet »

scott_s wrote: post #223
logfromblammo wrote: post #193

Earlier quoted context omitted.

The good scammers absolutely will not be scared off by the need to pay a penny to steal a dollar. You have to buy a cheap watch/violin/purse if you want to pass it off as an expensive one. You have to pay off in the back of the operation if you want to keep cash coming in through the front. Indeed, one of the easy ways to short-circuit human trust defenses is to make a show of trust first, such as by placing personal…

I don't disagree with your reasoning. But: I posit there are fewer "good scammers" than "scammers." Added friction probably reduces the total number of active scammers.

The huge number of fraudulent and malware-ish apps for android vs iOS does suggest that costs reduce the number of low quality attackers. I guess that is good for protecting the naive user. But I'm more concerned about protecting against the threat that will take your whole digital identity.

Re: Notepad++ drops code signing for its releases

#286

Post by tomc1985 »

cwyers wrote: post #78
tomc1985 wrote: post #43

Earlier quoted context omitted.

Factors keep both items expensive, and both are effectively required for doing certain types of business.

Medallions are an artificial constraint on supply -- the point of them is to shrink the market. Code signing provides a benefit -- it's a way for a user to ensure they have the right installer and that it wasn't changed by a nefarious third party.

And are code-signing certs really so different? The reporting and regulatory requirements behind them make me think that they are an intentional barrier-to-entry for newcomers, amateurs, and startups, and the business student in me admires their moat-like quality. Code-signing certs lock a lot of people out of certain channels of software distribution

Re: Notepad++ drops code signing for its releases

#287

Post by pvg »

angry_octet wrote: post #282
pvg wrote: post #190

Earlier quoted context omitted.

The signed app can be globally disabled.

This could be easily achieved by Microsoft running a free signing service. Lowering the cost of signing to zero would significantly increase the proportion of signed apps.

The question was 'is someone who spends money for code signing more trustworthy than someone who doesn't' and it was being treated as if the trust or at least, increase in comfort, somehow comes merely from the act of spending money. It's an opt-in to a service that mitigates the impact of malicious code.

Re: Notepad++ drops code signing for its releases

#288

Post by fjabre »

duxup wrote: post #48
fjabre wrote: post #37

Earlier quoted context omitted.

Of course but all of the above mentioned can still happen and does happen today with all security measures in place. With the added benefit that we must ask permission of a private entity to release an app and we must pay 30% of our profits to the gatekeepers /s I think I like the old way better.

I don't think I understand what the difference is with the "old way" if as you describe it ... there seems to be no difference. You don't have to pay some cert provider under the old or current way.

You do if you want your app not to be flagged as spam. Users are perceptive. They notice when windows brings up a big notice telling them the app is not to be trusted.

Perception is everything in those first few moments a user get his hands on your software. But now if I dont pay the entrance fee I potentially get abandoned by said user bc they have been scared off.

Its not an app store yet. Give it 5 or 10 years when we no longer have an open web and all we have are walled gardens.

Re: Notepad++ drops code signing for its releases

#289

Post by zamadatix »

theandrewbailey wrote: post #118
gambler wrote: post #84

Earlier quoted context omitted.

LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with encryption, so having analogous CA for code would be entirely meaningless. What does code signing in Windows actually verify? That executable's author at some point paid money to some company that Microsoft deemed an "authority"? It's a rotten system. The whole C…

> LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Have you used Let's Encrypt? It verifies that you own the domain in question. HTTPS requires that the server you're connecting to has been identified.

Operator != owner. I can break into your car, doesn't mean I can take it to the local DMV and get a new title with my name on it purely because I showed up in it.

Re: Notepad++ drops code signing for its releases

#290

Post by zamadatix »

drexlspivey wrote: post #83
tabulatouch wrote: post #73

Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?

You don't get to sign a petition for someone else to work for free

Who said anything about people working for free? That's not how the example (Let's Encrypt) works so why are you bringing it up now?
Post reply on HN