Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

31–40 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#31

Post by labster »

smokel wrote: post #16
mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

By that logic, reading a classic novel such as Anna Karenina would set you back $720. [1] [1] https://www.readinglength.com/book/isbn-0143035002

That’s why you hire a 10x reader at $200/hour.

Re: The Windows installer of ImageMagick will no longer be signed

#32

Post by cookiengineer »

wannacboatmovie wrote: post #26
gary_0 wrote: post #5

We need a LetsEncrypt for executable signing. Although I suspect Microsoft and Apple are making distributing executables for their platforms costly and inconvenient on purpose in order to drive developers onto their app stores. If that's the case, I guess we'll just have to train users to ignore all the security prompts about unsigned installers (some developers already do).

The whole point of digital signing is to verify and have strong trust in the provenance of the code. This requires identity validation and controls for it to actually work, which is fundamentally incompatible with a Let's Encrypt-style pretend-CA. This means storage of keys in hardware. Otherwise code signing keys are stolen and used for malware distribution in high profile attacks. This happened one too many times h…

The whole point of identity verification is pointless, given LOLbins and LOLdrivers that are never updated nor fixed.

I wish we had a cryptographic verification mechanism based on code and reproducibility of their builds, and local-sensitive hashing mechanisms rather than the current ones.

Technically this might actually be a decentralized ledging use case that makes sense.

Re: The Windows installer of ImageMagick will no longer be signed

#33

Post by [deleted] »

mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

[deleted]

Re: The Windows installer of ImageMagick will no longer be signed

#34

Post by nwellinghoff »

mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

It’s principle. A fundamental of the hacker mentality. A hacker will jump through hoops to do something based on principle. Something others legitimately have a hard time understanding. That being said why the HELL is it 629 dollars!?

Re: The Windows installer of ImageMagick will no longer be signed

#35

Post by [deleted] »

gary_0 wrote: post #5

We need a LetsEncrypt for executable signing. Although I suspect Microsoft and Apple are making distributing executables for their platforms costly and inconvenient on purpose in order to drive developers onto their app stores. If that's the case, I guess we'll just have to train users to ignore all the security prompts about unsigned installers (some developers already do).

[deleted]

Re: The Windows installer of ImageMagick will no longer be signed

#36

Post by andyfleming »

throwawaaarrgh wrote: post #15
mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

> Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. Simple: there is no business model. Open Source is not a business. It is a philosophy and hobby, where people help each other and give away their labor with no expectation of a return. (Some youngsters that have grown up in the social media age have developed a kind of entitlement complex…

I'm not sure whether or not there's an issue of entitlement, but there's certainly incentives to develop a popular package (even if superficially). One big one is career development. For people early in their career, it's something they can proactively invest in, as where they can't magically materialize years of experience overnight.

Re: The Windows installer of ImageMagick will no longer be signed

#37

Post by [deleted] »

mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

[deleted]

Re: The Windows installer of ImageMagick will no longer be signed

#38

Post by electroly »

technion wrote: post #14

Just throwing in that the dollar value isn't the only cost. I've been using an automated release workflow tomanage signing, eg https://github.com/technion/rustypwneddownloader/blob/main/.... This worfklow isn't usable with these new rules, and I'm having a hard time with the assertion that moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an im…

I'm in exactly the same boat; doing the same thing to store my OV .pfx certificate in a GitHub Actions secret. My certificate expires in November 2024 and I'm undecided what I'll do. It was hard enough to get a certificate as a solo developer and not a corporation.

Still, though, it should just be a matter of money. The $629/year cloud-hosted HSM mentioned in the OP will do it. If you pay that, you can use this procedure to make it work with GitHub Actions with the same sort of signtool or Set-AuthenticodeSignature command that you use now: https://docs.digicert.com/en/software-trust-manager/ci-cd-in...

Re: The Windows installer of ImageMagick will no longer be signed

#39

Post by Rodeoclash »

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time.

I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for.

I would love to see a LetsEncrypt style service for OSS but I assume it's against the core interests of Microsoft / Apple to allow something like this as it would start to drive people away from the walled gardens of the app stores.

I've been writing software for close to 25 years and it's quite sad to watch the decline of ownership over our own machines in the same of "security".

[1] https://www.vodon.gg/

Re: The Windows installer of ImageMagick will no longer be signed

#40

Post by umvi »

Seems like security is slowly eating the software world. At some point security will be so onerous that it will take more effort than the actual software being secured. Software was more fun in the good old days before there was a huge criminal industry exploiting it. Alas, it was bound to happen eventually.

That said, seems like you could bring down that price by hosting the key yourself with a yubikey or cloud hsm instead of buying the turn key solution from digicert.

Post reply on HN