Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

41–50 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#41

Post by Dalewyn »

throwawaaarrgh wrote: post #15
mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

> Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. Simple: there is no business model. Open Source is not a business. It is a philosophy and hobby, where people help each other and give away their labor with no expectation of a return. (Some youngsters that have grown up in the social media age have developed a kind of entitlement complex…

There is definitely an argument to be made that open source should be viewed and treated as a business model, particularly if there are financial costs involved which must be paid one way or another.

Dogma and fervor don't pay the bills.

Re: The Windows installer of ImageMagick will no longer be signed

#42

Post by 01100011 »

throwawaaarrgh wrote: post #11

Maybe someone can start signing a Windows release of GraphicsMagick? http://www.graphicsmagick.org/index.html Also FYI, Bob is pleading for some volunteers to help manage the project; he's doing it all on his own as a side project. If you can, please put the word out

Interesting. I tried to remove imagemagick from Ubuntu 22.04 but it is depended upon by inkscape, calibre and pdfsandwich. I wonder if it's possible for these projects to use GM instead?

Re: The Windows installer of ImageMagick will no longer be signed

#44

Post by bitwize »

DaiPlusPlus wrote: post #4

I"m curious what the actual negative impact of this would be - ImageMagick is a command-line tool (or runs in-proc somehow) and rarely used directly by end-users, just like LAME and ffmpeg - and the binaries are far more often shipped as part of another application. My day-job SaaS uses ImageMagick on Windows (long story), but this doesn't affect us - I imagine most other users will be the same. I'm surprised they ev…

Windows Defender assumes files of unknown provenance are malicious and will block or quarantine them -- even (especially!) if they came from a zip file rather than an installer. Anyone who wishes to distribute binaries for Windows needs to have them signed.

Re: The Windows installer of ImageMagick will no longer be signed

#45

Post by atesti »

How does this work? Does Digicert "host" the HSM in the cloud for you and make it possible to automate things again?

The goal of us developers is of course to fully automatically sign an executable, while the CAB forum seems to want one to always enter a pin code in a hw device anytime you make a build.

Are there any good solutions or hacks to automate it? Does Digicert really make it possible again to just invoke signing of anything from the command line or CI task WITHOUT entering any pin or 2factor stuff? That would be great, and of course ultimately circumvent the CAB forum's demands as anyone who stole the digicert credentials can now sign anything.

Re: The Windows installer of ImageMagick will no longer be signed

#46

Post by fragmede »

woodruffw wrote: post #23
uxp8u61q wrote: post #18

Earlier quoted context omitted.

Wait, their certificates aren't trusted by the os? What's the point of their service, then? A self-signed certificate accomplishes the same result!

There are lots of systems (and ecosystems) where host trust doesn’t matter, like containers or language-specific package management. Sigstore is currently well-suited for those contexts. With a self-signed certificate, you are effectively your own PKI. The goal is generally to deduplicate that kind of work while also providing better security properties than “my host trusts self-signed certificates from a root CA tha…

Well the assumption is that the root CA stores them more safely than "on my laptop in my unlocked bedroom in an unassuming neighborhood of brighton" that most developers lean on for their secret storage, but, well, you never know.

Re: The Windows installer of ImageMagick will no longer be signed

#48

Post by snnn »

woodruffw wrote: post #23
uxp8u61q wrote: post #18

Earlier quoted context omitted.

Wait, their certificates aren't trusted by the os? What's the point of their service, then? A self-signed certificate accomplishes the same result!

There are lots of systems (and ecosystems) where host trust doesn’t matter, like containers or language-specific package management. Sigstore is currently well-suited for those contexts. With a self-signed certificate, you are effectively your own PKI. The goal is generally to deduplicate that kind of work while also providing better security properties than “my host trusts self-signed certificates from a root CA tha…

A more specific example: nuget allows pinning the certs. https://learn.microsoft.com/en-us/nuget/reference/nuget-conf... I feel signing a nuget package with a self-signed cert is not worse than any PGP signing method in term of trust level. They both are identified by a crypto fingerprint and you have to manually get the fingerprint from somewhere and just trust it. I do not see a big difference there.

Re: The Windows installer of ImageMagick will no longer be signed

#49

Post by justsomehnguy »

DaiPlusPlus wrote: post #4

I"m curious what the actual negative impact of this would be - ImageMagick is a command-line tool (or runs in-proc somehow) and rarely used directly by end-users, just like LAME and ffmpeg - and the binaries are far more often shipped as part of another application. My day-job SaaS uses ImageMagick on Windows (long story), but this doesn't affect us - I imagine most other users will be the same. I'm surprised they ev…

You will be prompted 'do you want to run this executable' if an installer of something would try to run IM installer. Similar to WireShark and WinPcap. If some retards pushed ghostscript people to remove the silent installer then this can lead to anything, up to alien invasion.

> I'm surprised they even make an installer for Windows at-all instead of only shipping portable zips.

You really appreciate that when you are managing a fleet. Though you can always slap a script or NSIS installer yourself, it's way easier if it's already done.

Re: The Windows installer of ImageMagick will no longer be signed

#50

Post by [deleted] »

umvi wrote: post #40

Seems like security is slowly eating the software world. At some point security will be so onerous that it will take more effort than the actual software being secured. Software was more fun in the good old days before there was a huge criminal industry exploiting it. Alas, it was bound to happen eventually. That said, seems like you could bring down that price by hosting the key yourself with a yubikey or cloud hsm…

[deleted]
Post reply on HN