Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

141–150 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#141

Post by alkonaut »

matharmin wrote: post #109

I recently went through this same issue at my company - only found out about the change in requirements when I couldn't renew my cert at the previous provider. There is surprisingly little info available on how to do code signing for Windows now. I don't want to use a physical device - with fully remote teams it's not feasible. Eventually settled on Azure KeyVault with Digicert (I don't like Comodo aka Sectigo). Ther…

I’m thinking that it might be by design that it’s somewhat hard and expensive.

Re: The Windows installer of ImageMagick will no longer be signed

#142

Post by keepamovin »

pentagrama wrote: post #139
keepamovin wrote: post #59

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…

$629/year

Sure. Yep that’s what i meant. 629/yr. It’s travesty they can’t afford it.

Can’t edit now. Thank you for clarifying!

Re: The Windows installer of ImageMagick will no longer be signed

#143

Post by Derbasti »

TeMPOraL wrote: post #140
keepamovin wrote: post #59

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…

> can’t even scrape together $629 for something as essential as a software signature I don't think the $629 itself is the problem, but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Is it about security, or is it about crying "security" to push through a pay-to-play market?

And moreso for a cross-platform tool. Essentially it's forcing devs to spend money on the Windows platform only, where they might prefer to spend it in a way that benefits all their users.

Re: The Windows installer of ImageMagick will no longer be signed

#144

Post by alkonaut »

vkazanov wrote: post #118
pjmlp wrote: post #87

Earlier quoted context omitted.

Windows developers are perfectly fine without WSL. WSL is meant for UNIX developers to bring their habits into non-UNIX OS, just like IBM mainframes and micros have PASE.

Aren't that many pure windevs left these days... In many professional circles Windows itself is no more than a vintage curiosity. So in many ways, WSL is a survival strategy - it makes it possible to stay a relevant developer while working in windows. BTW, I know a case where WSL is nothing short of brilliant: online game development. A lot of times, the backend is running linux only, while the client is windows only…

I think that’s perhaps a selection bias. Tons of people work on windows desktop apps, Microsoft stacks (sharepoint/office/power..) but what they do isn’t on GitHub, it doesn’t end up on Twitter or HN. Perhaps not even on the StackOverflow dev survey. We just go to work and write software. I also think that it’s a matter of where you are at. If you ask anyone in Silicon Valley what tech they use, few will say Windows, C++, C# or COBOL. But if you ask in traditional industry (manufacturing, chemical, …) and perhaps in Germany rather than the US, you’ll get a completely different answer.

Re: The Windows installer of ImageMagick will no longer be signed

#145

Post by alkonaut »

geraldcombs wrote: post #138
nolist_policy wrote: post #120

Yet another reason to go with web apps/electron. The electron binary is already signed. And Web apps are good with a Letsencrypt cert.

How are Electron apps typically shipped? If the answer is "inside an installer" then the installer needs to be signed.

These days in 99 cases of 100 I’d use something like Sqirrel to install per-user and enable self updates. But it’s still and executable and I still think Windows Defender will react poorly to an unsigned one even if it isn’t going to need any elevated privileges.

Re: The Windows installer of ImageMagick will no longer be signed

#146

Post by alkonaut »

throwawaaarrgh wrote: post #15
mg wrote: post #2

It is interesting, that the lack of a feature that would cost $629 to add is significant enough to make it the the HN front page. Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. There are 152 contributors to this project who wrote 21,686 commits. If each commit took an hour of work, and we value each hour at $50, that is $1,084,300 worth…

> Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. Simple: there is no business model. Open Source is not a business. It is a philosophy and hobby, where people help each other and give away their labor with no expectation of a return. (Some youngsters that have grown up in the social media age have developed a kind of entitlement complex…

Still, high profile projects should be able to raise this type of money with ease.

If they would say “Would match our ‘donation’ and donate $10 each year that we put in $1k in labor to this project?” that sounds like some commercial users would accept. But the first problem with medium scale OSS like this is that it’s no one’s hobby to manage projects or beg for money.

It’s also a problem that OSS contribution/sponsorship isn’t normalized in corporations. I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person.

Re: The Windows installer of ImageMagick will no longer be signed

#147

Post by firebaze »

alkonaut wrote: post #144
vkazanov wrote: post #118

Earlier quoted context omitted.

Aren't that many pure windevs left these days... In many professional circles Windows itself is no more than a vintage curiosity. So in many ways, WSL is a survival strategy - it makes it possible to stay a relevant developer while working in windows. BTW, I know a case where WSL is nothing short of brilliant: online game development. A lot of times, the backend is running linux only, while the client is windows only…

I think that’s perhaps a selection bias. Tons of people work on windows desktop apps, Microsoft stacks (sharepoint/office/power..) but what they do isn’t on GitHub, it doesn’t end up on Twitter or HN. Perhaps not even on the StackOverflow dev survey. We just go to work and write software. I also think that it’s a matter of where you are at. If you ask anyone in Silicon Valley what tech they use, few will say Windows,…

Well I'm from germany, working for a quite large software shop. Windows is definitely going away. Ten years ago Windows Apps had around 50% of devs allocated, now it's down to at most 15%, dying quite fast. Even the windows devs use mostly WSL tools where they exist.

SaaS is the future, and Windows didn't find its place in that space.

Re: The Windows installer of ImageMagick will no longer be signed

#148

Post by alkonaut »

ImAnAmateur wrote: post #6

Any opinions on this tool? I've literally never heard of it before. Seems like it's good for simple bulk editing.

It parses complex payloads like images in code written using an unsafe language. It’s not an issue using it yourself with your own data but I’d be wary of putting it anywhere in a pipeline where it would be fed user provided data, e.g to generate thumbnails in a backend or similar.

Re: The Windows installer of ImageMagick will no longer be signed

#149

Post by withinboredom »

nolist_policy wrote: post #136
withinboredom wrote: post #96

Earlier quoted context omitted.

> Sandboxing should be default. Please no. There are valid reasons to NOT sandbox, and in Windows there is sandboxing in default (windows store apps) and there are often issues with those versions of the software. For example, Slack downloaded from the windows store uses 30-40% of your CPU while idle, but not when installed from their website. Even in Linux and using the Snap sandbox (ubuntu), there are significant i…

The problem is that sandboxing is an afterthought on these platforms.

That is obvious. Like saying the "sun is yellow because it is about 4.5 billion years old."

Even if sandboxing was thought about back when Linus was porting Unix, it would have been extremely slow as processors and ram was very limited back then. If we could go back in time and give them ridiculously fast processors and effectively unlimited ram like we have today, I'm sure Linux and Windows (er, DOS) would look quite different, and be much slower.

Just look at how slow mobile OS's are, despite being on ridiculously fast hardware. My Palm Pilot in 1998 felt faster and more responsive than most devices today. Android devices essentially require a human to manage the memory because starting just a few apps uses almost all of it. Even iOS devices can only run a few apps before it starts killing things. Sandboxing has an extremely high cost (with not much to gain), so high that even on modern hardware you start running into physical limits very quickly: memory, disk space, and processing power.

Until we can properly share resources in sandboxed apps (or increase the physical limits of the hardware) to a certain point, it just doesn't make sense to only be able to run a few things on a desktop machine.

Re: The Windows installer of ImageMagick will no longer be signed

#150

Post by keepamovin »

TeMPOraL wrote: post #140
keepamovin wrote: post #59

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…

> can’t even scrape together $629 for something as essential as a software signature I don't think the $629 itself is the problem, but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Is it about security, or is it about crying "security" to push through a pay-to-play market?

It’s a valid point you raise. Certainly conceivable. Whatever the security ramifications, however, the usability consequences are real and important.

See my other comment for how i consider this may be cartel behavior: https://news.ycombinator.com/item?id=38056460

Post reply on HN