Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

161–170 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#161

Post by TeMPOraL »

alkonaut wrote: post #146
throwawaaarrgh wrote: post #15

Earlier quoted context omitted.

> Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. Simple: there is no business model. Open Source is not a business. It is a philosophy and hobby, where people help each other and give away their labor with no expectation of a return. (Some youngsters that have grown up in the social media age have developed a kind of entitlement complex…

Still, high profile projects should be able to raise this type of money with ease. If they would say “Would match our ‘donation’ and donate $10 each year that we put in $1k in labor to this project?” that sounds like some commercial users would accept. But the first problem with medium scale OSS like this is that it’s no one’s hobby to manage projects or beg for money. It’s also a problem that OSS contribution/sponso…

But why should they raise this money?

The unspoken assumption here is that code signing is a good thing. I question this assumption, particularly with how this works today. Microsoft, the cert issuers, and other companies involved in this are trying to create a reality in which software must always be attached to a specific legal entity, and then that entity must be vetted through the "corporate web of trust". That $629 (per year?) isn't paying to access/license a feature. It's a membership fee in that "corporate web of trust".

It's a nice way to disempower users and individual developers, while effectively commercializing the entire Open Source space. "Want to have your open source project to have any users (on proprietary OS-es)? You need to start a company and sign a contract with one of our approved business friends."

Re: The Windows installer of ImageMagick will no longer be signed

#162

Post by TeMPOraL »

dwattttt wrote: post #133
rivepica wrote: post #55

Earlier quoted context omitted.

The issue here is the high financial burden to have a secure/signed release, not the security itself.

I always assumed it wasn't the cost per say that provided value; malware authors certainly could lay hands to $630. The value is in actually asserting authorship & tying it to a legal identity. I'd assume creating a fake persona / faking whatever is required to satisfy the identity checks that come with that $630 is the actual deterrent. If it was cheap to perform the actual identity checks it would still provide thi…

And arguably the issue also isn't with money - it's that the value in "actually asserting authorship & tying it to a legal identity" is primarily a value for commercial vendors and platform owners. It's forcing open source developers to entangle themselves in the very system that open source culture is (or was) fundamentally in opposition to.

Re: The Windows installer of ImageMagick will no longer be signed

#163

Post by pjmlp »

firebaze wrote: post #147
alkonaut wrote: post #144

Earlier quoted context omitted.

I think that’s perhaps a selection bias. Tons of people work on windows desktop apps, Microsoft stacks (sharepoint/office/power..) but what they do isn’t on GitHub, it doesn’t end up on Twitter or HN. Perhaps not even on the StackOverflow dev survey. We just go to work and write software. I also think that it’s a matter of where you are at. If you ask anyone in Silicon Valley what tech they use, few will say Windows,…

Well I'm from germany, working for a quite large software shop. Windows is definitely going away. Ten years ago Windows Apps had around 50% of devs allocated, now it's down to at most 15%, dying quite fast. Even the windows devs use mostly WSL tools where they exist. SaaS is the future, and Windows didn't find its place in that space.

I am also located in Germany, and there are plenty of Windows jobs, it no accident that Germany is still one of the markets that is relevant for products like Delphi, with an annual conference.

Many SaaS products like Sitecore power several Mittelstand companies.

Re: The Windows installer of ImageMagick will no longer be signed

#164

Post by TeMPOraL »

keepamovin wrote: post #150
TeMPOraL wrote: post #140

Earlier quoted context omitted.

> can’t even scrape together $629 for something as essential as a software signature I don't think the $629 itself is the problem, but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Is it about security, or is it about crying "security" to push through a pay-to-play market?

It’s a valid point you raise. Certainly conceivable. Whatever the security ramifications, however, the usability consequences are real and important. See my other comment for how i consider this may be cartel behavior: https://news.ycombinator.com/item?id=38056460

My point is slightly different. You're focusing on fees, and open source being an industry in itself. Quoting from the linked comment:

> This lack of awareness hampers [open source community's] ability to participate effectively in the marketplace, including financial transactions to sustain itself.

Thing is, a large part of that community doesn't want to "participate effectively in the marketplace". The community started as a way to refuse playing the market game. Good or bad, visionary or naive, this was the OG culture, and remains potent in a subset of the larger OSS world.

> While I agree that small fees can serve as proof of identity—verifying that the software indeed comes from the claimed source, which seems to be one main intent of signatures—I don’t understand why these fees have to be exorbitant.

Again, I don't think the price is the problem, nor even that there is a fee. The problem is that "verifying that the software indeed comes from the claimed source" is done by requiring the software to be developed or controlled by a specific legal entity, and requiring that entity to establish trust via business relationships with the network of companies centered around major software corporations. It's forcing the entire OSS ecosystem (or at least the parts that directly, or transitively, target proprietary platforms) to commercialize.

Now, while I'm strongly biased against what I consider "security disempowering users and sucking out all the fun from computing", I'm not going to argue that this is entirely 100% bad, or that software devs have right to remain anonymous. Maybe, long-term, it's the only way forward. But right now, it feels like being colonized. "Yes, nice stuff you're making there, our citizens love it, and we've made some good money on it too. But from now on, you're no longer welcome on this land, unless you accept citizenship and become legible to our bureaucracy."

Re: The Windows installer of ImageMagick will no longer be signed

#165

Post by AussieWog93 »

3c6bYDXLMj wrote: post #127
leosarev wrote: post #110

Earlier quoted context omitted.

I think it would be fine to have code signing certificate ensures that signer controls a certain DNS name. I'm fine with "installer have been signed with somebody who owns imagemagick.org"

Yes, but most people aren’t. It also significantly reduces the usefulness of code signing for the vast majority. And your justification for that is that it personally wouldn’t be a big deal to you, someone that has an abnormal understanding of the technologies at play.

>It also significantly reduces the usefulness of code signing for the vast majority

I'd argue that code signing for the average person has zero utility on Windows, and negative utility on macOS.

I really don't think anybody understands or even cares what a certificate means, and the only practical outcome is that sometimes they get scary messages when the app they're installing didn't pay MS for a license.

Re: The Windows installer of ImageMagick will no longer be signed

#166

Post by keepamovin »

TeMPOraL wrote: post #164
keepamovin wrote: post #150

Earlier quoted context omitted.

It’s a valid point you raise. Certainly conceivable. Whatever the security ramifications, however, the usability consequences are real and important. See my other comment for how i consider this may be cartel behavior: https://news.ycombinator.com/item?id=38056460

My point is slightly different. You're focusing on fees, and open source being an industry in itself. Quoting from the linked comment: > This lack of awareness hampers [open source community's] ability to participate effectively in the marketplace, including financial transactions to sustain itself. Thing is, a large part of that community doesn't want to "participate effectively in the marketplace" . The community s…

Thanks for your comprehensive response. I consider these topics deeply important, and worthy of a lot of consideration.

I sensed we had a disagreement but likely tried to side step that to avoid any conflict, because I don’t really want to engage in that online. I’m glad to see I was right with my instinct and thank you for elaborating further just what any disagreement might be there! :)

Please allow me some time to read, understand and consider what you said and maybe I’ll get back to you!

Re: The Windows installer of ImageMagick will no longer be signed

#167

Post by nolist_policy »

withinboredom wrote: post #149
nolist_policy wrote: post #136

Earlier quoted context omitted.

The problem is that sandboxing is an afterthought on these platforms.

That is obvious. Like saying the "sun is yellow because it is about 4.5 billion years old." Even if sandboxing was thought about back when Linus was porting Unix, it would have been extremely slow as processors and ram was very limited back then. If we could go back in time and give them ridiculously fast processors and effectively unlimited ram like we have today, I'm sure Linux and Windows (er, DOS) would look quit…

Performance has absolutely nothing to do with sandboxing.

Heck you could already apply many sandboxing techniques with Linux 0.x by chroot() to an empty directory followed by setuid() to "nobody". If that process needs file access, fork() a broker process before the chroot() that funnels file descriptors over an unix socket to the sandboxed process. The broker strictly checks file access permissions of course or could even present the file open dialog to the user.

This is next to no overhead in many cases (keep in mind you'll stat/open/mmap a bunch of .so's anyways on startup), except for the fork() maybe. And that can be fixed by proper sandboxing API's by the OS.

The problem is that these OS's give the processes to much permissions in the fist place (access to all the user's files, ...).

Re: The Windows installer of ImageMagick will no longer be signed

#168

Post by vkazanov »

pjmlp wrote: post #163
firebaze wrote: post #147

Earlier quoted context omitted.

Well I'm from germany, working for a quite large software shop. Windows is definitely going away. Ten years ago Windows Apps had around 50% of devs allocated, now it's down to at most 15%, dying quite fast. Even the windows devs use mostly WSL tools where they exist. SaaS is the future, and Windows didn't find its place in that space.

I am also located in Germany, and there are plenty of Windows jobs, it no accident that Germany is still one of the markets that is relevant for products like Delphi, with an annual conference. Many SaaS products like Sitecore power several Mittelstand companies.

Well, Germany is not exactly a powerhouse of IT innovation these days.

I took a few week-long professional courses related to low-level stuff in Munich and elsewhere in Germany, and it felt as is most other students were either working in finance or car making industries.

Both industries are conservative (for a good reason), and generally lag behind the mainstream by at least 10 years. I am not even saying Silicon Valley maintream, no. It's more like moving from pure embedded to Linux, or replacing a 30-40 year old OS with Linux. A lot of Windows machines.

To explain why this feelt so strange to me. In London, UK outside of City any decent IT company looks like the following: developers use either Mac or Linux machines (4 to 1); non-technical or semi-technical audience (HR, DevRels, marketing, design, etc) uses Macs; finance and legal teams mostly use Windows.

Technically speaking, all backends, all of compute, everything is based on Linux. On-prem, cloud, whatever - always Linux.

So for somebody wanting to stick with Windows WSL becomes a necessity.

Re: The Windows installer of ImageMagick will no longer be signed

#169

Post by pjmlp »

vkazanov wrote: post #168
pjmlp wrote: post #163

Earlier quoted context omitted.

I am also located in Germany, and there are plenty of Windows jobs, it no accident that Germany is still one of the markets that is relevant for products like Delphi, with an annual conference. Many SaaS products like Sitecore power several Mittelstand companies.

Well, Germany is not exactly a powerhouse of IT innovation these days. I took a few week-long professional courses related to low-level stuff in Munich and elsewhere in Germany, and it felt as is most other students were either working in finance or car making industries. Both industries are conservative (for a good reason), and generally lag behind the mainstream by at least 10 years. I am not even saying Silicon Va…

Well, I know of several companies in Wales doing Windows development.

Re: The Windows installer of ImageMagick will no longer be signed

#170

Post by TeMPOraL »

keepamovin wrote: post #166
TeMPOraL wrote: post #164

Earlier quoted context omitted.

My point is slightly different. You're focusing on fees, and open source being an industry in itself. Quoting from the linked comment: > This lack of awareness hampers [open source community's] ability to participate effectively in the marketplace, including financial transactions to sustain itself. Thing is, a large part of that community doesn't want to "participate effectively in the marketplace" . The community s…

Thanks for your comprehensive response. I consider these topics deeply important, and worthy of a lot of consideration. I sensed we had a disagreement but likely tried to side step that to avoid any conflict, because I don’t really want to engage in that online. I’m glad to see I was right with my instinct and thank you for elaborating further just what any disagreement might be there! :) Please allow me some time to…

Thanks :). To be clear, I think what you wrote is true as well - it's a part of a larger picture. In my replies, I want to point at another part of that same picture, one I saw is not talked about at all in this thread, and which I believe may be more relevant to this case (because let's be honest, $629 for a project this widely used is peanuts, so it can't be the whole issue).
Post reply on HN