Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

81–90 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#81

Post by pjmlp »

doophus wrote: post #71
tsimionescu wrote: post #61

Earlier quoted context omitted.

How could it not? It is adding software to the system software set, accessible by all users of the system. And many programs require some kind of integration into the OS, such as file type associations or context menu entries, which even a single user shouldn't have access to do.

Most software installers on Windows offer the user a "Install for this user"/"Install for all users" option, or will just install to the current user's appdata, which doesn't require admin rights.

Not the case for ImageMagick, there are some things that cannot be installed for current user, like Windows services or specific kinds of shell extensions.

Re: The Windows installer of ImageMagick will no longer be signed

#82

Post by justinclift »

Has anyone here tried out that SignPath (https://signpath.org) thing mentioned in one of the responses?

From their website:

    SignPath Foundation provides reliable code signing for Open Source projects.
If it's legit, then it could be a useful option.

Re: The Windows installer of ImageMagick will no longer be signed

#84

Post by 1letterunixname »

snnn wrote: post #22

Compare to codesign, vulnerability management is more concerning. Ubuntu users should know that security patches for ImageMagick are not free! If you do not believe that, read this https://ubuntu.com/security/notices/USN-6393-1 . The security patch is only provided through Ubuntu's Expanded Security Maintenance (ESM) plan, which means you must pay for it. So, seriously, consider having you own build. Then there is no…

nix and habitat are alternative ways to bring user-space additions outside of a distro's package management in a repeatable manner. Otherwise, one has to make their own packages and run their own CI/CD package builders. I did this for Erlang, Elixir, and rebar3 since the corporate consultants who ran a YUM repo appeared to have stopped providing such for CentOS 9 stream. I think it's less painful to either standardize on 1 OS and add custom RPM/DEB packages, or ignore what the OS provides and vendor all user-space dependencies to an isolated stable path with a different packaging/build system.

Re: The Windows installer of ImageMagick will no longer be signed

#85

Post by universa1 »

technion wrote: post #14

Just throwing in that the dollar value isn't the only cost. I've been using an automated release workflow tomanage signing, eg https://github.com/technion/rustypwneddownloader/blob/main/.... This worfklow isn't usable with these new rules, and I'm having a hard time with the assertion that moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an im…

Hmm, not sure on GitHub actions, but wouldn't a local ci runner solve this? A small sff/Atom PC for approx 100$ with the hardware key attached...

So all that would change is where the signing part happens, either in the cloud or on your local runner...

Not sure which way to lean if this is an improvement or not security wise :-)

Re: The Windows installer of ImageMagick will no longer be signed

#86

Post by r4indeer »

1letterunixname wrote: post #79
r4indeer wrote: post #63

Earlier quoted context omitted.

What does this have to do with ImageMagick? They don't control the versions packaged by Canonical [0]. The bug you referenced is fixed in upstream, which you can access for free on GitHub. Ubuntu users on 22.04 LTS or later are also unaffected, because the release came with a version that was already patched [1]. If you upgrade to a newer Ubuntu release, there is no need to pay for ESM. Your comment makes it sound li…

You appear to be leaping to the wrong conclusion. The problem is Canonical charging money for security updates. CentOS, Alma, Rocky, Fedora, Debian, openSUSE, Arch, and 300+ other Linux distros don't charge money for security updates either. The moral of the story is "Don't use enshitifying corporate Linux distros run by crazy people."

This still has nothing to do with the ImageMagick developers, which the original comment implies: "Compare [sic] to codesign, vulnerability management is more concerning."

You are free to criticize Canonical for their business model, but that seems off-topic to me right now.

Re: The Windows installer of ImageMagick will no longer be signed

#87

Post by pjmlp »

theanonymousone wrote: post #52

Let's normalise using WSL for all such command-line utilities. Everyone's life will be easier, from developrs to users.

Windows developers are perfectly fine without WSL.

WSL is meant for UNIX developers to bring their habits into non-UNIX OS, just like IBM mainframes and micros have PASE.

Re: The Windows installer of ImageMagick will no longer be signed

#88

Post by pjmlp »

toastal wrote: post #83
theanonymousone wrote: post #52

Let's normalise using WSL for all such command-line utilities. Everyone's life will be easier, from developrs to users.

Skip the ‘WS’ part & just use the ‘L’

The Year of Desktop Linux is around the corner!

Re: The Windows installer of ImageMagick will no longer be signed

#89

Post by charcircuit »

Ayesh wrote: post #51

Now that GitHub has CI and MSFT money, it would make so much sense for GitHub to become a code signing CA! With npm, you can opt in to have your npm package releases signed, and it took less than five minutes for me to integrate. As long as the package is published with GitHub Actions (or other supported CIs I guess), you can sign the package and npmjs shows it as well. Git also has release and commit signing with gp…

These code certs verify the orginization who created the executable. Those are not the same guarentees as a signature for a commit.

Re: The Windows installer of ImageMagick will no longer be signed

#90

Post by Too »

tsimionescu wrote: post #61
ikekkdcjkfke wrote: post #54

Earlier quoted context omitted.

Why does an installer need admin rights though

How could it not? It is adding software to the system software set, accessible by all users of the system. And many programs require some kind of integration into the OS, such as file type associations or context menu entries, which even a single user shouldn't have access to do.

This way of working should have been left behind in the previous century.

Sandboxing should be default. Associating file endings should be a suggestion to the OS, accepted by the user, not something only configurable by delegating full super admin to third party app.

Slow loading context menus where every app tries to claim its presence. Thank you for reminding me why I don’t use Windows since years ago.

A image editor should only need to load and save images I ask it to, no other system integration. iOS, Android and the browser has proven it is possible. Now the desktop needs a similar journey.

Post reply on HN