Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

91–100 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#91
post #51

Now that GitHub has CI and MSFT money, it would make so much sense for GitHub to become a code signing CA! With npm, you can opt in to have your npm package releases signed, and it took less than five minutes for me to integrate. As long as the package is published with GitHub Actions (or other supported CIs I guess), you can sign the package and npmjs shows it as well. Git also has release and commit signing with gp…

Code signing certificates are supposed to assure that the owner of the key has been verified to be a specific legal entity (person or organization), and also to assure a certain level of protection of the private key, such as being managed by an HSM. NPM signing or SSH keys don't provide any such assurance.

Re: The Windows installer of ImageMagick will no longer be signed

#92
post #72
post #65

Earlier quoted context omitted.

you see it as a failure of the tech industry to finance open source. I see it as a failure to provide security systems like this without the need for financial gatekeeping. $629.00 isn't a trivial amount of money.

Considering the scale of ImageMagick- $629 is a very, very small amount of money considering the value that IM has generated.

Have you considered volunteering to pay for and run the signing infrastructure?

Re: The Windows installer of ImageMagick will no longer be signed

#93
post #51

Now that GitHub has CI and MSFT money, it would make so much sense for GitHub to become a code signing CA! With npm, you can opt in to have your npm package releases signed, and it took less than five minutes for me to integrate. As long as the package is published with GitHub Actions (or other supported CIs I guess), you can sign the package and npmjs shows it as well. Git also has release and commit signing with gp…

These code certs verify the orginization who created the executable. Those are not the same guarentees as a signature for a commit.

If the GitHub action only takes the source repo itself as input, you can review the state of the repo, including the .github/workflows to ensure that the executable was created consistently from given commit.

This assumes the actions are not downloading content from other places, which I’m not sure is easy to enforce given prevalence of package managers. Meaning workflows has to be reviewed manually for such.

Re: The Windows installer of ImageMagick will no longer be signed

#94
post #65

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…

you see it as a failure of the tech industry to finance open source. I see it as a failure to provide security systems like this without the need for financial gatekeeping. $629.00 isn't a trivial amount of money.

Good point about the size of fees. However, I don’t mostly view the problem as the tech industry failing to fund open source.

I think that framing overly emphasizes an existing problem, which is the perception that OSS is sort of a charity. This misperception only reinforces the negative sense of entitlement that people have towards open source.

A couple of ways that the sense of entitlement manifests itself is the expectation that OSS should be free and, if money is involved, then it should be in the form of pay-what-you-want donations, or subscriptions, not tied to a specific exchange of value. The concept of funding can encompass this vagueness.

The word ‘Transactions’, I think, is a more precise and correct term, as it more clearly relates to desired and sustainable goal of a defined and measured exchange of value.

So instead of the issue being merely the providing of funding, rather, I see it as an issue with the open-source community not fully recognizing that it’s an industry in its own right.

This lack of awareness hampers its ability to participate effectively in the marketplace, including financial transactions to sustain itself.

On another note, I share your view that these fees are troublesome. While I agree that small fees can serve as proof of identity—verifying that the software indeed comes from the claimed source, which seems to be one main intent of signatures—I don’t understand why these fees have to be exorbitant.

It seems more like artificial price inflation, perhaps even a form of cartel behavior.

Re: The Windows installer of ImageMagick will no longer be signed

#95

Any opinions on this tool? I've literally never heard of it before. Seems like it's good for simple bulk editing.

ImageMagick is the most widely used open source image processing library and tool in the world. The source code kinda sucks but it does everything you could want, pretty much

It is a common source of security vulnerabilities.

Also the API is has silly names, uses globals, not really nice, and not really FFI friendly (overcomplicated).

Also requires global installation, cannot be deployed side by side with projects.

For me it is a solid red flag for any project if they are using ImageMagick/GraphicsMagic. I don't let it near my computers.

Re: The Windows installer of ImageMagick will no longer be signed

#96
post #90

Earlier quoted context omitted.

How could it not? It is adding software to the system software set, accessible by all users of the system. And many programs require some kind of integration into the OS, such as file type associations or context menu entries, which even a single user shouldn't have access to do.

This way of working should have been left behind in the previous century. Sandboxing should be default. Associating file endings should be a suggestion to the OS, accepted by the user, not something only configurable by delegating full super admin to third party app. Slow loading context menus where every app tries to claim its presence. Thank you for reminding me why I don’t use Windows since years ago. A image edit…

> Sandboxing should be default.

Please no. There are valid reasons to NOT sandbox, and in Windows there is sandboxing in default (windows store apps) and there are often issues with those versions of the software. For example, Slack downloaded from the windows store uses 30-40% of your CPU while idle, but not when installed from their website.

Even in Linux and using the Snap sandbox (ubuntu), there are significant issues when trying to access globally available software, which can be extremely hard to support and diagnose.

Re: The Windows installer of ImageMagick will no longer be signed

#97
post #75

Earlier quoted context omitted.

It’s also not clear why the IM project should be paying MS and not the other way round…

But that's a thin line. Free certificates negate security. Instead, there are various foundations that sponsor popular open source projects for costs like signing certificates and hosting. I'm sure one of these should be trustworthy enough to obtain a signing certificate themselves so they can issue and revoke certs to various projects without much cost.

Look at it this way, why should a project like IM pay MicroSoft for the privilege of enriching and adding value to the Windows platform?

Re: The Windows installer of ImageMagick will no longer be signed

#98
post #5

We need a LetsEncrypt for executable signing. Although I suspect Microsoft and Apple are making distributing executables for their platforms costly and inconvenient on purpose in order to drive developers onto their app stores. If that's the case, I guess we'll just have to train users to ignore all the security prompts about unsigned installers (some developers already do).

That’s the idea behind Sigstore[1]. The larger challenge is the vendors themselves: Sigstore (or anyone else, really) can give code-signing certificates and tooling to developers for free, but that tooling has limited value if the host OS doesn’t bundle the CA certificates that would enable native validation. [1]: https://www.sigstore.dev/

Sigstore doesn’t seem to verify actual legal identity, just control over a GitHub account or similar. It therefore doesn’t provide the same level of assurance as a code-signing certificate. OSs thus do well to not bundle their CA certificate as a trusted root.

Re: The Windows installer of ImageMagick will no longer be signed

#99
post #91
post #51

Now that GitHub has CI and MSFT money, it would make so much sense for GitHub to become a code signing CA! With npm, you can opt in to have your npm package releases signed, and it took less than five minutes for me to integrate. As long as the package is published with GitHub Actions (or other supported CIs I guess), you can sign the package and npmjs shows it as well. Git also has release and commit signing with gp…

Code signing certificates are supposed to assure that the owner of the key has been verified to be a specific legal entity (person or organization), and also to assure a certain level of protection of the private key, such as being managed by an HSM. NPM signing or SSH keys don't provide any such assurance.

Hmm... my github org, owned by my business has my business's tax information (and verified), as well as my business billing information. It sounds like they should be reasonably confident that the org is my business.

Re: The Windows installer of ImageMagick will no longer be signed

#100
post #75

Earlier quoted context omitted.

But that's a thin line. Free certificates negate security. Instead, there are various foundations that sponsor popular open source projects for costs like signing certificates and hosting. I'm sure one of these should be trustworthy enough to obtain a signing certificate themselves so they can issue and revoke certs to various projects without much cost.

Look at it this way, why should a project like IM pay MicroSoft for the privilege of enriching and adding value to the Windows platform?

The fee for code signing certificates doesn't go to Microsoft.
Post reply on HN