Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

Post reply on HN
Print view View original

301–310 of 335 posts

Re: Notepad++ drops code signing for its releases

#301

Post by cm2187 »

tomc1985 wrote: post #284
cm2187 wrote: post #252

Earlier quoted context omitted.

The key has no value if anyone can sign the binaries in the name of the developper. Then the binaries might as well not be signed.

Not really. The point of origin is the private key, which does need to be protected. Lack of identity verification might make key revocation/rotation more difficult, but identity is not really permanently coupled to the keypair. If that were true then why is the only thing stopping me from circulating self-signed certificates with bogus info the lack of a CA signature?

Well, that's the whole point, windows doesn't accept self-signed certificates. It has to be signed by a CA. And to know you are executing the code from the original developer as opposed to some repackaging by a malware, you need to be able to observe the identity as stated by the CA, and it has to be meaningful to you (a function in the browser performed by you having typed the domain name of the website).

If anyone can get a certificate from a reputable CA under the name of Microsoft Inc, then how do you know you are executing guenine Microsoft code? You don't have the public key of every reputable developer installed on your machine, and the CA won't check for reputability or malware, just that the identity is who the certificate claims it is.

Re: Notepad++ drops code signing for its releases

#302

Post by SyneRyder »

robinwassen wrote: post #299
Twisell wrote: post #139

Earlier quoted context omitted.

Wait are you saying that Apple Developer program for 99$/year is actually quite a good deal in comparison? I will definitely pull this thread out next time someone complain that Apple is too expensive and that they are milking the poor developers...

You can buy a Comodo Code Sign cert for $95 if you buy from a reseller rather than direct.

According to juliusmusseau's comment, you can even get it down to $61/year. (I've used KSoftware for signing certs before and would recommend them too.)

https://news.ycombinator.com/item?id=19330504

Re: Notepad++ drops code signing for its releases

#303

Post by snvzz »

antsar wrote: post #64
zrobotics wrote: post #33

Earlier quoted context omitted.

>>FOSS and reading all the code... Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.

And compile your compiler, and ... (In reference to the classic paper: https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7... )

That's why there's been so much work on reproducible builds.

Re: Notepad++ drops code signing for its releases

#304

Post by juliusmusseau »

pvg wrote: post #298
AnthonyMouse wrote: post #296

Earlier quoted context omitted.

In what way is this not two separate things uselessly duplicating the same functionality? If you can get a CRL you can get a definition update, and they both effectively do the same thing.

They are very much not the same thing. A signed app can be distributed from anywhere with the assurance it's the same app - it can't be maliciousified and if it was malicious from the start, it can be disabled. The non-signed up can have zillions of malicious variants which something like Defender may or may not catch. It also gets a shot of circumventing (or even exploiting) AV.

Also, the "disable" in the signed case is much more powerful, since it disables all apps signed by the same key.

Re: Notepad++ drops code signing for its releases

#305

Post by martin_a »

juliusmusseau wrote: post #104
Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

> but he won't be able to obtain that until he has some kind of business or organization registered in his jurisdiction with that name.

Even in good old bureaucratic Germany this will take you less than an hour and cost you about 30€. Can't believe it can be much worse anywhere else.

Re: Notepad++ drops code signing for its releases

#306

Post by angry_octet »

pvg wrote: post #287
angry_octet wrote: post #282

Earlier quoted context omitted.

This could be easily achieved by Microsoft running a free signing service. Lowering the cost of signing to zero would significantly increase the proportion of signed apps.

The question was 'is someone who spends money for code signing more trustworthy than someone who doesn't' and it was being treated as if the trust or at least, increase in comfort, somehow comes merely from the act of spending money. It's an opt-in to a service that mitigates the impact of malicious code.

The parent statement was that having signed apps made them easy to disable. If all apps had to be signed, everything would have a reputation hook, and also be easily disabled. It's the hang-up of using the for profit 'verified' code signing ecosystem that makes signing ineffective.

Of course, MSFT/Apple etc will abuse it to kill apps they/govt don't like.

Re: Notepad++ drops code signing for its releases

#307

Post by Tempest1981 »

angry_octet wrote: post #282
pvg wrote: post #190

Earlier quoted context omitted.

The signed app can be globally disabled.

This could be easily achieved by Microsoft running a free signing service. Lowering the cost of signing to zero would significantly increase the proportion of signed apps.

Apps submitted to the Microsoft Store are signed by Microsoft (only), iirc.

Although it costs $19 or $99 to sign up, one time.

Re: Notepad++ drops code signing for its releases

#308

Post by vnnkov »

flukus wrote: post #248
juliusmusseau wrote: post #104

Earlier quoted context omitted.

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

> Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Ever notice how most con-men wear nice suits? Your advocating for the digital equivalent.

Ever noticed how con-men in nice suit is much more convincing than the one in tracking suit?

Re: Notepad++ drops code signing for its releases

#309

Post by pvg »

angry_octet wrote: post #306
pvg wrote: post #287

Earlier quoted context omitted.

The question was 'is someone who spends money for code signing more trustworthy than someone who doesn't' and it was being treated as if the trust or at least, increase in comfort, somehow comes merely from the act of spending money. It's an opt-in to a service that mitigates the impact of malicious code.

The parent statement was that having signed apps made them easy to disable. If all apps had to be signed, everything would have a reputation hook, and also be easily disabled. It's the hang-up of using the for profit 'verified' code signing ecosystem that makes signing ineffective. Of course, MSFT/Apple etc will abuse it to kill apps they/govt don't like.

I don't really understand how any of this makes signing ineffective.

Re: Notepad++ drops code signing for its releases

#310

Post by mizaru »

alerighi wrote: post #229
juliusmusseau wrote: post #104

Earlier quoted context omitted.

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

Well I don't care if the developer payed the certificate, and I don't see why someone that develops FOSS should pay money for something that doesn't bring to him any of that money back. At least for open source software certificates should be offered for free, in my opinion. Also the fact that you are required to have a corporation, why? If I develop again an open source software I need to register a corporation just…

Certum offers cheap code signing certificates for open source developers. I don't know how "good" they are, though, just stumbled across them a while ago because MPC-BE is using one.
Post reply on HN