There are some open source technologies keeping the internet-as-we-know-it alive. Surely the might of Github and Microsoft could support them or, even better, a consortia of the Big Tech companies could get together a comittee, like they often do for standards, and agree to fund the most used open source projects with stipends, grants, security audits and some sort of badge of trustability.
The Windows installer of ImageMagick will no longer be signed
181–190 of 364 posts
Re: The Windows installer of ImageMagick will no longer be signed
#182Earlier quoted context omitted.
I think it would be fine to have code signing certificate ensures that signer controls a certain DNS name. I'm fine with "installer have been signed with somebody who owns imagemagick.org"
Will you notice if the software will be signed by certificate for "imagemaqick.com" or "imagemagik.com" or "imagemagick-developers.com"?
Hopefully Windows will remember that I downloaded the file from imagemagic.com check that the certificate matches the place I downloaded it from...
Although... As long as downloads are always provided from the official domain via HTTPS, and the OS can keep track of that, I don't really see why the executable itself needs to be signed...
Re: The Windows installer of ImageMagick will no longer be signed
#183So much for 'Developers, developers, developers!'. If there is one thing that seems to be common amongst large tech companies it is that it all starts out looking great, then after a few years the rot sets in and if they manage to hang on long enough eventually they turn into parasitic entities. There is no way that a company the size of Microsoft could not come up with a way of working that would enable the FOSS wor…
Well said!
Re: The Windows installer of ImageMagick will no longer be signed
#184It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…
... having to pay $629 just to ship a thing you made for free?
I refuse to accept this as a normal thing to do. Microsoft inflicted this upon the Windows ecosystem themselves.
Re: The Windows installer of ImageMagick will no longer be signed
#185I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…
I think that a main part of LetsEncrypt security comes from renewing the certificate every 3 months. You would not be able to do that with shipped binaries.
Re: The Windows installer of ImageMagick will no longer be signed
#186Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system. GUI programs should be able to call "open" "save" and other dialogs to get handles to files, not just their names. The OS should limit access to resources to those it provides (as capability tokens) and nothing else. For CLI programs, the…
So, a music player that keeps a database on 25000+ files needs to hold and manage 25000+ capability tokens? Do I have to select all those files in an "Open" dialog box?
Hell naw, dawg.
Re: The Windows installer of ImageMagick will no longer be signed
#187Earlier quoted context omitted.
> Makes me feel like I would like to learn more about open source. What drives it's development and what the business models are. Simple: there is no business model. Open Source is not a business. It is a philosophy and hobby, where people help each other and give away their labor with no expectation of a return. (Some youngsters that have grown up in the social media age have developed a kind of entitlement complex…
Still, high profile projects should be able to raise this type of money with ease. If they would say “Would match our ‘donation’ and donate $10 each year that we put in $1k in labor to this project?” that sounds like some commercial users would accept. But the first problem with medium scale OSS like this is that it’s no one’s hobby to manage projects or beg for money. It’s also a problem that OSS contribution/sponso…
> I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person.
Because business has it's own logic. If you invest $5k in a product, you are expecting the return to be customer support, quality control, timely bug fixing, "enterprise" features, feature request priority, legal indemnification / due diligence, etc. You make a business case to justify the expense, with the expectation that this is going to provide a return (eventually) in the form of revenue, time/cost savings, etc.
Donations in and of themselves don't provide any obvious return. If the project kept a "business case" page that includes what the donation goes to and shows the direct benefits that come from donation, it's much easier to justify the cost. And you might think "can't they just write off the donation?", but the project would need 501(c)(3) status, and it's apparently quite[1] hard[2] to get OSS approved as such.
[1] https://web.archive.org/web/20221201141451/https://opensourc... [2] https://www.mill.law/blog/more-501c3-rejections-open-source-...
Re: The Windows installer of ImageMagick will no longer be signed
#188Earlier quoted context omitted.
Why does an installer need admin rights though
How could it not? It is adding software to the system software set, accessible by all users of the system. And many programs require some kind of integration into the OS, such as file type associations or context menu entries, which even a single user shouldn't have access to do.
> How could it not? It is adding software to the system software set, accessible by all users of the system.
User-only installs are possible:
> C:\Users\YourUsername\AppData\Local is intended for MSI installations for a single user but typically doesn't require Administrative privileges. This folder is normally hidden.
* https://superuser.com/questions/1327037/what-choices-do-i-ha...
This is the variable %LOCALAPPDATA%:
* https://pureinfotech.com/list-environment-variables-windows-...
See also perhaps CSIDL_DEFAULT_APPDATA and CSIDL_DEFAULT_LOCAL_APPDATA:
* https://learn.microsoft.com/en-us/windows/deployment/usmt/us...
Re: The Windows installer of ImageMagick will no longer be signed
#189Earlier quoted context omitted.
I am also located in Germany, and there are plenty of Windows jobs, it no accident that Germany is still one of the markets that is relevant for products like Delphi, with an annual conference. Many SaaS products like Sitecore power several Mittelstand companies.
Well, Germany is not exactly a powerhouse of IT innovation these days. I took a few week-long professional courses related to low-level stuff in Munich and elsewhere in Germany, and it felt as is most other students were either working in finance or car making industries. Both industries are conservative (for a good reason), and generally lag behind the mainstream by at least 10 years. I am not even saying Silicon Va…
That’s the thing though: software development isn’t IT innovation. Most software is probably written at companies that aren’t primarily software companies. It’s done in traditional firms in manufacturing, banks, mining, whatever.
Even if Germany continues to be less prominent in the software industry, more software lines of code will be written in Germany every year.
The thing about windows is that even when 100% of developers left it, most non-devs will still use it. So if you make software for them, you are going to need it. I make a cad program. We can’t really leave Windows and even doing multi platform or web based make financial sense.
Re: The Windows installer of ImageMagick will no longer be signed
#190I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…
I think that a main part of LetsEncrypt security comes from renewing the certificate every 3 months. You would not be able to do that with shipped binaries.
I mean, you certainly _could_ - most users don't try to regularly reinstall the same binary they downloaded.