Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

101–110 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#101

Post by mikewarot »

Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system. GUI programs should be able to call "open" "save" and other dialogs to get handles to files, not just their names. The OS should limit access to resources to those it provides (as capability tokens) and nothing else.

For CLI programs, the shell should take care of managing parameters in a standard and trustable way, also returning tokens instead of file names.

Collectively, we're like chicken caught out in a rainstorm... looking up, frozen in panic. Some of us know how to get out of the rain... but we're stuck in the middle of the flock.

Re: The Windows installer of ImageMagick will no longer be signed

#102

Post by charcircuit »

gary_0 wrote: post #53
wannacboatmovie wrote: post #26

Earlier quoted context omitted.

The whole point of digital signing is to verify and have strong trust in the provenance of the code. This requires identity validation and controls for it to actually work, which is fundamentally incompatible with a Let's Encrypt-style pretend-CA. This means storage of keys in hardware. Otherwise code signing keys are stolen and used for malware distribution in high profile attacks. This happened one too many times h…

A certificate that says "this installer really did come from the owner of exampleapp.com" is better than users just trusting whatever random file came up in a Google search. And meanwhile, in Linux land, people will install things by piping curl into bash[0][1], so the bar is just not that high. And the ultimate answer to security will come from better app sandboxing, not from charging every native-app developer in t…

>meanwhile, in Linux land

Just because some operating systems are decades behind on security that does not mean that security does not matter.

Re: The Windows installer of ImageMagick will no longer be signed

#103

Post by withinboredom »

layer8 wrote: post #98
woodruffw wrote: post #9

Earlier quoted context omitted.

That’s the idea behind Sigstore[1]. The larger challenge is the vendors themselves: Sigstore (or anyone else, really) can give code-signing certificates and tooling to developers for free, but that tooling has limited value if the host OS doesn’t bundle the CA certificates that would enable native validation. [1]: https://www.sigstore.dev/

Sigstore doesn’t seem to verify actual legal identity, just control over a GitHub account or similar. It therefore doesn’t provide the same level of assurance as a code-signing certificate. OSs thus do well to not bundle their CA certificate as a trusted root.

Github already provides a proxy of actual legal identity, at least in the EU. For a business owned org, the VAT id is provided along with validation and billing information must match.

Re: The Windows installer of ImageMagick will no longer be signed

#104

Post by layer8 »

Too wrote: post #93
charcircuit wrote: post #89

Earlier quoted context omitted.

These code certs verify the orginization who created the executable. Those are not the same guarentees as a signature for a commit.

If the GitHub action only takes the source repo itself as input, you can review the state of the repo, including the .github/workflows to ensure that the executable was created consistently from given commit. This assumes the actions are not downloading content from other places, which I’m not sure is easy to enforce given prevalence of package managers. Meaning workflows has to be reviewed manually for such.

If a non-technical end user installs malware, it doesn't help them that they could have inspected the source commit of said malware.

Re: The Windows installer of ImageMagick will no longer be signed

#105

Post by withinboredom »

fodkodrasz wrote: post #95
throwawaaarrgh wrote: post #7

Earlier quoted context omitted.

ImageMagick is the most widely used open source image processing library and tool in the world. The source code kinda sucks but it does everything you could want, pretty much

It is a common source of security vulnerabilities. Also the API is has silly names, uses globals, not really nice, and not really FFI friendly (overcomplicated). Also requires global installation, cannot be deployed side by side with projects. For me it is a solid red flag for any project if they are using ImageMagick/GraphicsMagic. I don't let it near my computers.

Too bad it is already there...

Re: The Windows installer of ImageMagick will no longer be signed

#106

Post by thangalin »

My desktop text editor, KeenWrite, uses Wine, rcedit-x64.exe, osslsigncode, and a shell script to sign the Windows binary. First, rcedit-x64.exe tags the binary with identifying information:

https://gitlab.com/DaveJarvis/KeenWrite/-/blob/main/installe...

Then osslsigncode applies the certificate:

https://gitlab.com/DaveJarvis/KeenWrite/-/blob/main/scripts/...

Echoing what Rodeoclash wrote: Having to pay to play on Windows for an open-source project that makes $0 is a decline of ownership over our own machines.

Re: The Windows installer of ImageMagick will no longer be signed

#107

Post by galkk »

1letterunixname wrote: post #68
ilaksh wrote: post #19

Earlier quoted context omitted.

It's a racket.

Nawh, it's just a Scheme.

lol, I never thought about scheme/racket naming in this context.

Is this an inside joke in the community or maybe even a an official take?

Re: The Windows installer of ImageMagick will no longer be signed

#108

Post by oefrha »

system2 wrote: post #60
ikekkdcjkfke wrote: post #54

Earlier quoted context omitted.

Why does an installer need admin rights though

Unrecognized publisher warning in blue box (not UAC) comes up no matter what the software is when trying to install or run.

Moreover, a warning pops up even for signed binaries, until that binary has been installed enough times (?) and Microsoft is satisfied.

Re: The Windows installer of ImageMagick will no longer be signed

#109

Post by matharmin »

I recently went through this same issue at my company - only found out about the change in requirements when I couldn't renew my cert at the previous provider.

There is surprisingly little info available on how to do code signing for Windows now. I don't want to use a physical device - with fully remote teams it's not feasible. Eventually settled on Azure KeyVault with Digicert (I don't like Comodo aka Sectigo). There is really little info available on how to get it all to work together, and you have to spent around $600 before you can even try and see whether it can work.

Now that it's all configured, the setup works well. The new setup of doing the signing via Azure is more secure than storing the private keys on the CI system. But I never thought that signing an app for Windows would be more difficult than signing for macOS or iOS.

Re: The Windows installer of ImageMagick will no longer be signed

#110

Post by leosarev »

schoen wrote: post #69
Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

> I would love to see a LetsEncrypt style service for OSS but I assume it's against the core interests of Microsoft / Apple to allow something like this as it would start to drive people away from the walled gardens of the app stores. People have been asking Let's Encrypt itself for this on the Let's Encrypt forum since the project was founded. The usual answer is that code signing certificates are (supposedly) tryin…

I think it would be fine to have code signing certificate ensures that signer controls a certain DNS name.

I'm fine with "installer have been signed with somebody who owns imagemagick.org"

Post reply on HN