Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

51–60 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#51

Post by Ayesh »

Now that GitHub has CI and MSFT money, it would make so much sense for GitHub to become a code signing CA!

With npm, you can opt in to have your npm package releases signed, and it took less than five minutes for me to integrate. As long as the package is published with GitHub Actions (or other supported CIs I guess), you can sign the package and npmjs shows it as well.

Git also has release and commit signing with gpg/ssh keys, so the authentication is already solved.

https://github.blog/2023-04-19-introducing-npm-package-prove...

Re: The Windows installer of ImageMagick will no longer be signed

#53

Post by gary_0 »

wannacboatmovie wrote: post #26
gary_0 wrote: post #5

We need a LetsEncrypt for executable signing. Although I suspect Microsoft and Apple are making distributing executables for their platforms costly and inconvenient on purpose in order to drive developers onto their app stores. If that's the case, I guess we'll just have to train users to ignore all the security prompts about unsigned installers (some developers already do).

The whole point of digital signing is to verify and have strong trust in the provenance of the code. This requires identity validation and controls for it to actually work, which is fundamentally incompatible with a Let's Encrypt-style pretend-CA. This means storage of keys in hardware. Otherwise code signing keys are stolen and used for malware distribution in high profile attacks. This happened one too many times h…

A certificate that says "this installer really did come from the owner of exampleapp.com" is better than users just trusting whatever random file came up in a Google search.

And meanwhile, in Linux land, people will install things by piping curl into bash[0][1], so the bar is just not that high. And the ultimate answer to security will come from better app sandboxing, not from charging every native-app developer in the world $700/year for a code signing certificate.

[0] https://docs.chef.io/chef_install_script/ [1] https://github.com/zyedidia/micro#quick-install-script

Re: The Windows installer of ImageMagick will no longer be signed

#54

Post by ikekkdcjkfke »

Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

Why does an installer need admin rights though

Re: The Windows installer of ImageMagick will no longer be signed

#55

Post by rivepica »

umvi wrote: post #40

Seems like security is slowly eating the software world. At some point security will be so onerous that it will take more effort than the actual software being secured. Software was more fun in the good old days before there was a huge criminal industry exploiting it. Alas, it was bound to happen eventually. That said, seems like you could bring down that price by hosting the key yourself with a yubikey or cloud hsm…

The issue here is the high financial burden to have a secure/signed release, not the security itself.

Re: The Windows installer of ImageMagick will no longer be signed

#56

Post by jimmySixDOF »

throwawaaarrgh wrote: post #11

Maybe someone can start signing a Windows release of GraphicsMagick? http://www.graphicsmagick.org/index.html Also FYI, Bob is pleading for some volunteers to help manage the project; he's doing it all on his own as a side project. If you can, please put the word out

I am not sure I get the difference between these projects and have trie, also looked at libvips, but for me with a narrow use case of batch overlay text insertion I could not find anything.

Re: The Windows installer of ImageMagick will no longer be signed

#57

Post by ikekkdcjkfke »

Ayesh wrote: post #51

Now that GitHub has CI and MSFT money, it would make so much sense for GitHub to become a code signing CA! With npm, you can opt in to have your npm package releases signed, and it took less than five minutes for me to integrate. As long as the package is published with GitHub Actions (or other supported CIs I guess), you can sign the package and npmjs shows it as well. Git also has release and commit signing with gp…

That's still a single point of failure, so the signing doesn't provide any extra security

Re: The Windows installer of ImageMagick will no longer be signed

#58

Post by wetbaby »

ikekkdcjkfke wrote: post #54
Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

Why does an installer need admin rights though

I don't think he's saying it requires elevated privileges. When binaries aren't signed Windows will throw up a warning that it isn't signed which makes users hesitant to install.

Re: The Windows installer of ImageMagick will no longer be signed

#59

Post by keepamovin »

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature.

It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon.

Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves.

It’s a sobering reminder that something significant needs to change in how we approach and value open-source contributions.

Re: The Windows installer of ImageMagick will no longer be signed

#60

Post by system2 »

ikekkdcjkfke wrote: post #54
Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

Why does an installer need admin rights though

Unrecognized publisher warning in blue box (not UAC) comes up no matter what the software is when trying to install or run.
Post reply on HN