291–300 of 335 posts
Earlier quoted context omitted.
I have to say I agree here. Notepad++ if it provides hashes for the downloaded EXEs is completely in the right for not wanting to pay middle men for fancy "this is OK" screen on installation. That seems ridiculous and greedy.
Especially for a program that caters to developers. People will understand.
Earlier quoted context omitted.
This is fallacious reasoning. A well intentioned open source developer who does not earn any money out of a labor of love has no incentive to further spend money to sign his app that he’s giving away for free anyway. On the flip side, a malicious actor that expects to earn money through a scam has every incentive to spend some money making the app look legit, especially if there is no risk involved.
The signed app can be globally disabled.
Why can't the unsigned app be globally disabled? Is this not the basic premise behind Windows Defender and every other antivirus?
Earlier quoted context omitted.
Could you please stop posting unsubstantive comments and/or flamebait to HN? We're trying for something higher-quality than that on this site. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newswelcome.html
As you wish, I'll keep my opinion to myself.
It does take a bit of getting used to, but trading the pleasures of the internet rant for curiosity, which requires more measured conversation, is worth it in the long run. Think of it as a global optimization of the forum, which involves letting go of local optima.
Earlier quoted context omitted.
Is code signing part of what you get from Apple for your $99 developer fee? If so, then that suddenly feels like a bargain.
Yes, that fee includes the ability to sign iOS apps for local distribution and submit them to the App Store, where apple will sign them. On macOS, it also allows code signing for general distribution like Windows has, as well as App Store submissions. I think the issue most people have with the price is that on iOS there's way more limits on running locally without a cert (7 days max), but for someone who is a practi…
Hah! I don't know about you but when I first started app development I didn't even have a credit card, let alone $99 on it to spend. Thankfully I could install my apps on android for free.
Earlier quoted context omitted.
The signed app can be globally disabled.
> The signed app can be globally disabled. Why can't the unsigned app be globally disabled? Is this not the basic premise behind Windows Defender and every other antivirus?
Earlier quoted context omitted.
> The signed app can be globally disabled. Why can't the unsigned app be globally disabled? Is this not the basic premise behind Windows Defender and every other antivirus?
Well sure, a known-malicious app will be detected by Windows Defender, provided it has updates making it aware of the app. But a known-malicious signed app will also fail the code signature verification, in addition to the virus scan, if its certificate has been revoked.
Earlier quoted context omitted.
Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.
> if you can download a source and build the program yourself, then it's safe. I think only a loud (very small) minority think that. The rest of us know that's silly, and bringing it up to prove some point against "FOSS zealots" is also silly. FOSS does allow for independent code reviews (which do happen on some projects), but that's not the only reason FOSS > proprietary crap.
Your use of "crap" to describe proprietary software betrays your bias. It's dangerous to be emotional when we're talking about security, it's important to remain objective and data driven.
Not all proprietary software is crap and not all open source is safe. It's not that uncommon that companies whose very livelihood depends on their code being secure invest much more time and money auditing it, while open source is often a lot more lenient, because there's not real accountability nor negative effects for shipping insecure software.
Earlier quoted context omitted.
Well sure, a known-malicious app will be detected by Windows Defender, provided it has updates making it aware of the app. But a known-malicious signed app will also fail the code signature verification, in addition to the virus scan, if its certificate has been revoked.
In what way is this not two separate things uselessly duplicating the same functionality? If you can get a CRL you can get a definition update, and they both effectively do the same thing.
Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php
Wait are you saying that Apple Developer program for 99$/year is actually quite a good deal in comparison? I will definitely pull this thread out next time someone complain that Apple is too expensive and that they are milking the poor developers...
I created a huge rant on code signing certificates here: https://www.youtube.com/watch?v=mwuk0E-tfeg It's a nightmare. Complete scam. I needed this for Polar: https://getpolarized.io/ Mind you... it's Open Source but I still want my users to be able to download it without warnings. No joke - it took me 2 weeks to get the CSC with about 4 hours per day working on just this CSC issue. It's just a labyrinth of insanity…
For those that don't know, D&B stands for Dun & Bradstreet ( https://www.dnb.com/ ). They have this concept of a D-U-N-S Number which basically means information about your business is in their database. Last I checked expedited D&B was around $40 USD (10 business days) and same-day D&B around $500 USD. Free D&B said it would take 30 business days, but it actually only took them 5 business days when I applied for it.