The Windows installer of ImageMagick will no longer be signed
1–10 of 364 posts
Re: The Windows installer of ImageMagick will no longer be signed
#2It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page.
Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are.
There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth of time.
How can a project gather over a million dollars worth of work time, but not $629 for a certification service?
Re: The Windows installer of ImageMagick will no longer be signed
#3This might be a misunderstanding on my part, but why does the ImageMagick code-signing certificate need to meet CA/B Forum requirements? My understanding is that those requirements apply primarily to the Web PKI, and not other PKIs or certificate profiles like Authenticode.
(Regardless, vendor-specific code-signing schemes are a racket.)
Re: The Windows installer of ImageMagick will no longer be signed
#4I"m curious what the actual negative impact of this would be - ImageMagick is a command-line tool (or runs in-proc somehow) and rarely used directly by end-users, just like LAME and ffmpeg - and the binaries are far more often shipped as part of another application.
My day-job SaaS uses ImageMagick on Windows (long story), but this doesn't affect us - I imagine most other users will be the same.
I'm surprised they even make an installer for Windows at-all instead of only shipping portable zips.
Re: The Windows installer of ImageMagick will no longer be signed
#5We need a LetsEncrypt for executable signing. Although I suspect Microsoft and Apple are making distributing executables for their platforms costly and inconvenient on purpose in order to drive developers onto their app stores. If that's the case, I guess we'll just have to train users to ignore all the security prompts about unsigned installers (some developers already do).
Re: The Windows installer of ImageMagick will no longer be signed
#6Any opinions on this tool? I've literally never heard of it before. Seems like it's good for simple bulk editing.
Re: The Windows installer of ImageMagick will no longer be signed
#7Any opinions on this tool? I've literally never heard of it before. Seems like it's good for simple bulk editing.
ImageMagick is the most widely used open source image processing library and tool in the world. The source code kinda sucks but it does everything you could want, pretty much
Re: The Windows installer of ImageMagick will no longer be signed
#8It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…
Because the contributers do the work (the coding) for fun. If they would need to pay $50 so someone else does the work (the fun part) they wouldn't do it.
Re: The Windows installer of ImageMagick will no longer be signed
#9We need a LetsEncrypt for executable signing. Although I suspect Microsoft and Apple are making distributing executables for their platforms costly and inconvenient on purpose in order to drive developers onto their app stores. If that's the case, I guess we'll just have to train users to ignore all the security prompts about unsigned installers (some developers already do).
That’s the idea behind Sigstore[1]. The larger challenge is the vendors themselves: Sigstore (or anyone else, really) can give code-signing certificates and tooling to developers for free, but that tooling has limited value if the host OS doesn’t bundle the CA certificates that would enable native validation.
Re: The Windows installer of ImageMagick will no longer be signed
#10Any opinions on this tool? I've literally never heard of it before. Seems like it's good for simple bulk editing.
What curl is for network requests, this is for image operations. It is ubiquitous and pretty much a de-facto standard utility.