Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

191–200 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#191

Post by andygeorge »

jacquesm wrote: post #180

So much for 'Developers, developers, developers!'. If there is one thing that seems to be common amongst large tech companies it is that it all starts out looking great, then after a few years the rot sets in and if they manage to hang on long enough eventually they turn into parasitic entities. There is no way that a company the size of Microsoft could not come up with a way of working that would enable the FOSS wor…

Agreed.

That said - and maybe I'm missing something - but why did did ImageMagick wait til the _day of expiration_ to make this post?!

Re: The Windows installer of ImageMagick will no longer be signed

#192

Post by notpushkin »

mike_hearn wrote: post #159
AnthonyMouse wrote: post #156

Earlier quoted context omitted.

Why is it any less useful than some entity name? You can be pretty sure that google.com is controlled by Google, and if the domain on the app is g00gle.ru, that's going to fool exactly the same people as if the scammer's company name was Googel.

Because domain names are cheap and can be purchased in bulk. TLS certificates are for encryption. You don't care if the endpoint is "bad" in some way, only that you are communicating with it securely. Code signing certificates are to make bans stick. Totally different purpose.

Companies aren't cheap, but they aren't exactly expensive either. A couple weeks ago I've registered a company in Estonia – it only cost me the 265 € state fee. Code signing certificate is another what, 500 euro on top of that? Certainly more expensive than a $10 domain with a free certificate, but still could be a reasonable cost for e. g. a targeted attack.

There's another catch – you either have to register a company in your name, or find somebody to own it for you. I don't think the latter would be a big problem though: there was a lot of news about shady fintech startups in the Baltics lately and many of them were in fact registered in the name of random people looking for some quick cash.

Now, if I see something like MicroSoft-Inc OÜ (EE) in the app signature, I would probably get a bit suspicious. But if it's a less known brand? Who knows!

Re: The Windows installer of ImageMagick will no longer be signed

#193

Post by TeMPOraL »

alkonaut wrote: post #174
TeMPOraL wrote: post #161

Earlier quoted context omitted.

But why should they raise this money? The unspoken assumption here is that code signing is a good thing . I question this assumption, particularly with how this works today. Microsoft, the cert issuers, and other companies involved in this are trying to create a reality in which software must always be attached to a specific legal entity, and then that entity must be vetted through the "corporate web of trust". That…

As the comments on the issue suggests, $629 is not the minimum price tag. It can be much cheaper without being more complicated. But I agree Microsoft could probably make it easier and cheaper but I can’t see why they would want that given they want to drive apps to stores and not self publishing. They want the bad method of publishing to have bad ergonomics. A letsencrypt style signing process would be possible and…

> A letsencrypt style signing process would be possible and would let people base the trust on the ownership of company.com instead of a regular cert. And for most use cases this seems good enough.

Except it seems that's not what they want at all.

LetsEncrypt works because we've worked out it's sufficient for purposes of HTTPS to attest that "you" own the domain company.com, which is verified by making you do something that can be done only when "you" are in control of what company.com DNS points at. The nature of "you" is immaterial, out of scope - only demonstrating control over a domain matters. This lends itself to automation.

What they want to do with code signing is to pin the code to a specific legal entity. That's crossing from data integrity/provenance straight to KYC/legal space - for users to be allowed to run your code, you must become an entity that can be easily served a lawsuit should the need arise. You can't automate that, for the same reason you can't automate renewing your national ID/passport or automate starting a company.

Re: The Windows installer of ImageMagick will no longer be signed

#194

Post by notpushkin »

silvestrov wrote: post #185
Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

I think that a main part of LetsEncrypt security comes from renewing the certificate every 3 months. You would not be able to do that with shipped binaries.

Binaries are timestamped though. If you sign it, it's practically valid forever (unless you revoke the signature).

Re: The Windows installer of ImageMagick will no longer be signed

#195

Post by jcelerier »

Too wrote: post #90
tsimionescu wrote: post #61

Earlier quoted context omitted.

How could it not? It is adding software to the system software set, accessible by all users of the system. And many programs require some kind of integration into the OS, such as file type associations or context menu entries, which even a single user shouldn't have access to do.

This way of working should have been left behind in the previous century. Sandboxing should be default. Associating file endings should be a suggestion to the OS, accepted by the user, not something only configurable by delegating full super admin to third party app. Slow loading context menus where every app tries to claim its presence. Thank you for reminding me why I don’t use Windows since years ago. A image edit…

> iOS, Android and the browser has proven it is possible.

Whatever woes Windows's UX and design choices cause, I'd still take it a million times over any of these three terribly improductive environments

Re: The Windows installer of ImageMagick will no longer be signed

#196

Post by ChrisSD »

maccard wrote: post #179
TeMPOraL wrote: post #140

Earlier quoted context omitted.

> can’t even scrape together $629 for something as essential as a software signature I don't think the $629 itself is the problem, but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Is it about security, or is it about crying "security" to push through a pay-to-play market?

> but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Putting the price aside just for a second, are there really people out there who think that code signing isn't worthwhile? Remember paint.net/filezilla having ad links to "Download Now" that would download... not paint.net or filezilla?

Code signing wouldn't necessarily fix that. There are a lot of "legitimate" applications that a user wouldn't want. For example, spyware is fine if there's some plausible deniability to it because many applications do some form of spying nowadays.

Re: The Windows installer of ImageMagick will no longer be signed

#197

Post by theanonymousone »

pjmlp wrote: post #87
theanonymousone wrote: post #52

Let's normalise using WSL for all such command-line utilities. Everyone's life will be easier, from developrs to users.

Windows developers are perfectly fine without WSL. WSL is meant for UNIX developers to bring their habits into non-UNIX OS, just like IBM mainframes and micros have PASE.

The ImageMagick development team probably don't count themselves as Windows developers. At least not all of them.

Re: The Windows installer of ImageMagick will no longer be signed

#198

Post by livrem »

TeMPOraL wrote: post #152
vbezhenar wrote: post #134

Earlier quoted context omitted.

Because we're using operating systems rooting from 80-s and nobody's going to rewrite them from the scratch along with all the software running on top of them. Web applications are the best thing we could get.

Well, if Ubuntu Snaps are any indication, then I'm happy for the 1980s OS design. I mean, it's cool that you can get a sandboxed program with simple CLI comamnd. It sucks that it's completely useless until you figure out how to give it access to the host file system, because guess what, most software that's useful for anything other than entertainment needs to interoperate with other software using files . To be fair…

Feels like Android keeps making it worse, at least for older apps that have not been updated to whatever the most recent way to access files is. I have several old apps installed that I can't figure out any way to access files for anymore. Interop between termux shell and apps is also trickier than it used to be. And small things like trying to launch a text editor from Dosbox Turbo to edit autoexec.bat that used to work fine but now just results in some error.

I don't want anything like that on desktop. Some way of wrapping applications under my control (not some app stores control) and easily edit a simple text-file to give it permissions would be nice, but nothing beyond that.

Re: The Windows installer of ImageMagick will no longer be signed

#199

Post by teddyh »

fodkodrasz wrote: post #95
throwawaaarrgh wrote: post #7

Earlier quoted context omitted.

ImageMagick is the most widely used open source image processing library and tool in the world. The source code kinda sucks but it does everything you could want, pretty much

It is a common source of security vulnerabilities. Also the API is has silly names, uses globals, not really nice, and not really FFI friendly (overcomplicated). Also requires global installation, cannot be deployed side by side with projects. For me it is a solid red flag for any project if they are using ImageMagick/GraphicsMagic. I don't let it near my computers.

What do you use, then? Netpbm?

Re: The Windows installer of ImageMagick will no longer be signed

#200

Post by jcupitt »

jimmySixDOF wrote: post #56
throwawaaarrgh wrote: post #11

Maybe someone can start signing a Windows release of GraphicsMagick? http://www.graphicsmagick.org/index.html Also FYI, Bob is pleading for some volunteers to help manage the project; he's doing it all on his own as a side project. If you can, please put the word out

I am not sure I get the difference between these projects and have trie, also looked at libvips, but for me with a narrow use case of batch overlay text insertion I could not find anything.

We're off topic here, but in pyvips (for example) you can do text overlays like this:

https://github.com/libvips/pyvips/blob/master/examples/annot...

tldr: make an image containing your text, composite it over the image you want to annotate.

Post reply on HN