Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

121–130 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#121

Post by electroly »

veeti wrote: post #119
electroly wrote: post #115

Earlier quoted context omitted.

I was looking into Azure Key Vault Managed HSM and it appears to be vastly more expensive than the $629/year from Digicert. A Managed HSM Pool is $3.20/hour. Am I missing something?

You don't need a HSM, just a HSM backed key. It costs like $5 a month.

Can you point me at some more information about the difference? This would seem to be a much better deal than paying Digicert, but I'm confused about how it can be so cheap? Isn't the required for an HSM at all the reason it's so much more expensive now at other CAs?

Re: The Windows installer of ImageMagick will no longer be signed

#122

Post by charcircuit »

Too wrote: post #93
charcircuit wrote: post #89

Earlier quoted context omitted.

These code certs verify the orginization who created the executable. Those are not the same guarentees as a signature for a commit.

If the GitHub action only takes the source repo itself as input, you can review the state of the repo, including the .github/workflows to ensure that the executable was created consistently from given commit. This assumes the actions are not downloading content from other places, which I’m not sure is easy to enforce given prevalence of package managers. Meaning workflows has to be reviewed manually for such.

1. Buy compromised github account

2. Create public repo with just an exe of malware and whatever is needed to setup the action

3. Download the signed exe

4. Delete the repo

5. Repeat

It doesn't mean much.

Re: The Windows installer of ImageMagick will no longer be signed

#123

Post by veeti »

electroly wrote: post #121
veeti wrote: post #119

Earlier quoted context omitted.

You don't need a HSM, just a HSM backed key. It costs like $5 a month.

Can you point me at some more information about the difference? This would seem to be a much better deal than paying Digicert, but I'm confused about how it can be so cheap? Isn't the required for an HSM at all the reason it's so much more expensive now at other CAs?

I don't know what happens under the hood, but presumably a HSM key is on a shared HSM with other people whereas what you're talking about will get you a dedicated HSM.

We have set up Key Vault for code signing using this and it does work.

Re: The Windows installer of ImageMagick will no longer be signed

#124

Post by electroly »

veeti wrote: post #123
electroly wrote: post #121

Earlier quoted context omitted.

Can you point me at some more information about the difference? This would seem to be a much better deal than paying Digicert, but I'm confused about how it can be so cheap? Isn't the required for an HSM at all the reason it's so much more expensive now at other CAs?

I don't know what happens under the hood, but presumably a HSM key is on a shared HSM with other people whereas what you're talking about will get you a dedicated HSM. We have set up Key Vault for code signing using this and it does work.

Thanks so much for this. I will dig into this option, and it seems the ImageMagick people have been clued into the same solution.

Re: The Windows installer of ImageMagick will no longer be signed

#125

Post by Rodeoclash »

Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

Another pain point with this that I just remembered is that Chrome will also complain about the download if it isn't signed. This does seem to get switched off after enough downloads have been accrued.

Re: The Windows installer of ImageMagick will no longer be signed

#126

Post by veeti »

thangalin wrote: post #106

My desktop text editor, KeenWrite, uses Wine, rcedit-x64.exe, osslsigncode, and a shell script to sign the Windows binary. First, rcedit-x64.exe tags the binary with identifying information: https://gitlab.com/DaveJarvis/KeenWrite/-/blob/main/installe... Then osslsigncode applies the certificate: https://gitlab.com/DaveJarvis/KeenWrite/-/blob/main/scripts/... Echoing what Rodeoclash wrote: Having to pay to play on Wi…

As a heads up you are not going to be able to renew your certificate for this, it needs to be HSM backed now.

Re: The Windows installer of ImageMagick will no longer be signed

#127

Post by 3c6bYDXLMj »

leosarev wrote: post #110
schoen wrote: post #69

Earlier quoted context omitted.

> I would love to see a LetsEncrypt style service for OSS but I assume it's against the core interests of Microsoft / Apple to allow something like this as it would start to drive people away from the walled gardens of the app stores. People have been asking Let's Encrypt itself for this on the Let's Encrypt forum since the project was founded. The usual answer is that code signing certificates are (supposedly) tryin…

I think it would be fine to have code signing certificate ensures that signer controls a certain DNS name. I'm fine with "installer have been signed with somebody who owns imagemagick.org"

Yes, but most people aren’t. It also significantly reduces the usefulness of code signing for the vast majority. And your justification for that is that it personally wouldn’t be a big deal to you, someone that has an abnormal understanding of the technologies at play.

Re: The Windows installer of ImageMagick will no longer be signed

#128

Post by Kwpolska »

Rodeoclash wrote: post #64
system2 wrote: post #60

Earlier quoted context omitted.

Unrecognized publisher warning in blue box (not UAC) comes up no matter what the software is when trying to install or run.

This is correct and it usually takes some combination of right clicking the installer or holding shortcuts to bypass. It's not obvious how to do so without Googling around.

Right clicking is a Mac thing. On Windows, most of the warnings can be bypassed without any special actions (there are two buttons), the SmartScreen warning requires clicking on "More info".

Re: The Windows installer of ImageMagick will no longer be signed

#129

Post by kergonath »

lodovic wrote: post #75
rand846633 wrote: post #62

Earlier quoted context omitted.

It’s also not clear why the IM project should be paying MS and not the other way round…

But that's a thin line. Free certificates negate security. Instead, there are various foundations that sponsor popular open source projects for costs like signing certificates and hosting. I'm sure one of these should be trustworthy enough to obtain a signing certificate themselves so they can issue and revoke certs to various projects without much cost.

This does not solve the problem at all, and does not improve security either. Microsoft themselves could perfectly well have the same analysis in-house and provide free certificates to properly vetted projects. Adding layers of middlemen to deal with is a pain in the backside and a consequence is that some projects will just not bother. It’s inefficient on all levels and still does not protect from bad actors.

Re: The Windows installer of ImageMagick will no longer be signed

#130

Post by kergonath »

megraf wrote: post #72
serf wrote: post #65

Earlier quoted context omitted.

you see it as a failure of the tech industry to finance open source. I see it as a failure to provide security systems like this without the need for financial gatekeeping. $629.00 isn't a trivial amount of money.

Considering the scale of ImageMagick- $629 is a very, very small amount of money considering the value that IM has generated.

The problem is that available funding is not commensurate with value generated. And the value is in the hands of some companies that have very little incentive to give much of it to the upstream project.
Post reply on HN