Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

21–30 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#21

Post by rtpg »

mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

The classic thing is that "nobody uses Windows". The real thing of course is that many people contributing to various projects end up using some *nix setup. So despite Windows being a big part of many userbases, ultimately maintainers often don't even have a Windows machine, let alone the knowledge to deal with some Windows-specific issues or bugs.

Though here it seems to be mostly a money thing ($629/year is a real amount of "pocket change").

Re: The Windows installer of ImageMagick will no longer be signed

#22

Post by snnn »

Compare to codesign, vulnerability management is more concerning. Ubuntu users should know that security patches for ImageMagick are not free! If you do not believe that, read this https://ubuntu.com/security/notices/USN-6393-1. The security patch is only provided through Ubuntu's Expanded Security Maintenance (ESM) plan, which means you must pay for it. So, seriously, consider having you own build. Then there is no need to worry about codesign too.

Re: The Windows installer of ImageMagick will no longer be signed

#23

Post by woodruffw »

uxp8u61q wrote: post #18
woodruffw wrote: post #9

Earlier quoted context omitted.

That’s the idea behind Sigstore[1]. The larger challenge is the vendors themselves: Sigstore (or anyone else, really) can give code-signing certificates and tooling to developers for free, but that tooling has limited value if the host OS doesn’t bundle the CA certificates that would enable native validation. [1]: https://www.sigstore.dev/

Wait, their certificates aren't trusted by the os? What's the point of their service, then? A self-signed certificate accomplishes the same result!

There are lots of systems (and ecosystems) where host trust doesn’t matter, like containers or language-specific package management. Sigstore is currently well-suited for those contexts.

With a self-signed certificate, you are effectively your own PKI. The goal is generally to deduplicate that kind of work while also providing better security properties than “my host trusts self-signed certificates from a root CA that I keep on disk somewhere.”

Re: The Windows installer of ImageMagick will no longer be signed

#24

Post by charles_f »

uxp8u61q wrote: post #13
mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

> If each commit took an hour of work > we value each hour at $50 If you start with fantasy hypotheses like these, you're going to obtain fantasy conclusions.

In this specific case the estimate is likely a vast underestimation of the cost of work.

Re: The Windows installer of ImageMagick will no longer be signed

#25

Post by warent »

uxp8u61q wrote: post #18
woodruffw wrote: post #9

Earlier quoted context omitted.

That’s the idea behind Sigstore[1]. The larger challenge is the vendors themselves: Sigstore (or anyone else, really) can give code-signing certificates and tooling to developers for free, but that tooling has limited value if the host OS doesn’t bundle the CA certificates that would enable native validation. [1]: https://www.sigstore.dev/

Wait, their certificates aren't trusted by the os? What's the point of their service, then? A self-signed certificate accomplishes the same result!

The landing page linked above gives a pretty detailed write-up about the point of their service

Re: The Windows installer of ImageMagick will no longer be signed

#26

Post by wannacboatmovie »

gary_0 wrote: post #5

We need a LetsEncrypt for executable signing. Although I suspect Microsoft and Apple are making distributing executables for their platforms costly and inconvenient on purpose in order to drive developers onto their app stores. If that's the case, I guess we'll just have to train users to ignore all the security prompts about unsigned installers (some developers already do).

The whole point of digital signing is to verify and have strong trust in the provenance of the code.

This requires identity validation and controls for it to actually work, which is fundamentally incompatible with a Let's Encrypt-style pretend-CA.

This means storage of keys in hardware. Otherwise code signing keys are stolen and used for malware distribution in high profile attacks. This happened one too many times hence the more stringent requirements.

Ironically these guys want their cake and eat it too, there is no reason they couldn't just manually sign release builds which come once in a while. Many small OSS projects do this. No, they want full automation with an organization cert and now are complaining about meeting the requirements for that.

Re: The Windows installer of ImageMagick will no longer be signed

#27

Post by ilaksh »

gary_0 wrote: post #5

We need a LetsEncrypt for executable signing. Although I suspect Microsoft and Apple are making distributing executables for their platforms costly and inconvenient on purpose in order to drive developers onto their app stores. If that's the case, I guess we'll just have to train users to ignore all the security prompts about unsigned installers (some developers already do).

Absolutely! Another good option is to just use Linux.

Re: The Windows installer of ImageMagick will no longer be signed

#28

Post by a1369209993 »

mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

> How can a project gather over a million dollars worth of work time, but not $629 for a certification service?

Because the certification 'service' is a protection racket (as in criminal[0] racketeering) by Microsoft.

Millions for defence (or in this case infrastucture), but not a cent for tribute.

0: Since I'm sure some pedant will nitpick this: yes, I'm aware that large corporations have likely purchased legislation misclassifying this as not officially a crime; you know perfectly well what I mean.

Re: The Windows installer of ImageMagick will no longer be signed

#29

Post by xboxnolifes »

charles_f wrote: post #24
uxp8u61q wrote: post #13

Earlier quoted context omitted.

> If each commit took an hour of work > we value each hour at $50 If you start with fantasy hypotheses like these, you're going to obtain fantasy conclusions.

In this specific case the estimate is likely a vast underestimation of the cost of work.

The cost of work is based on the cost of finding someone to do the work. These people did the work for free. This specific work cost $0. The value the work provides may be higher, and I'd wager that ImageMagick has provided far more than $1,000,000 in value.

Re: The Windows installer of ImageMagick will no longer be signed

#30

Post by woodruffw »

smokel wrote: post #16
mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

By that logic, reading a classic novel such as Anna Karenina would set you back $720. [1] [1] https://www.readinglength.com/book/isbn-0143035002

Only a very small number of people are ordinarily paid to read Russian literature. The typical observation with OSS is that we would otherwise pay large amounts of money for equivalent labor in the software market.
Post reply on HN