Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

201–210 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#201

Post by alkonaut »

throwawaaarrgh wrote: post #187
alkonaut wrote: post #146

Earlier quoted context omitted.

Still, high profile projects should be able to raise this type of money with ease. If they would say “Would match our ‘donation’ and donate $10 each year that we put in $1k in labor to this project?” that sounds like some commercial users would accept. But the first problem with medium scale OSS like this is that it’s no one’s hobby to manage projects or beg for money. It’s also a problem that OSS contribution/sponso…

> I could much easier get permission to buy a $5k piece of software than donate $5 to an OSS project that powers out largest project and has been maintained for 10 years by a single person. Because business has it's own logic. If you invest $5k in a product, you are expecting the return to be customer support, quality control, timely bug fixing, "enterprise" features, feature request priority, legal indemnification /…

When the sole OSS maintainer says “I only got $23 in donations last year so I can’t spend as much time on bug fixes this year” that should be a case for donating $25. Especially if the end of maintenance would instantly cost five or six figures. The thing is that it’s hope that you get support for your $25. Not a contract guaranteeing it.

In the end the easiest option for me is to donate a $25 personally on my employers behalf and be done with it.

Re: The Windows installer of ImageMagick will no longer be signed

#202

Post by kuzko_topia »

matharmin wrote: post #109

I recently went through this same issue at my company - only found out about the change in requirements when I couldn't renew my cert at the previous provider. There is surprisingly little info available on how to do code signing for Windows now. I don't want to use a physical device - with fully remote teams it's not feasible. Eventually settled on Azure KeyVault with Digicert (I don't like Comodo aka Sectigo). Ther…

Hey, is there any chance you could do a writeup on how you did things? due to the lack of information you mention, I think it might be useful for a lot of people there, including me.

Re: The Windows installer of ImageMagick will no longer be signed

#203

Post by Y_Y »

withinboredom wrote: post #149
nolist_policy wrote: post #136

Earlier quoted context omitted.

The problem is that sandboxing is an afterthought on these platforms.

That is obvious. Like saying the "sun is yellow because it is about 4.5 billion years old." Even if sandboxing was thought about back when Linus was porting Unix, it would have been extremely slow as processors and ram was very limited back then. If we could go back in time and give them ridiculously fast processors and effectively unlimited ram like we have today, I'm sure Linux and Windows (er, DOS) would look quit…

The sun is white though.

Re: The Windows installer of ImageMagick will no longer be signed

#204

Post by iforgotpassword »

Reason077 wrote: post #175

> ”Digicert seems to be our only option now but a certificate there would cost $629 (tax excluded) for a single year.” Yikes! At least Mac (and iOS) developers get this for $99/year. What makes code signing so expensive on Windows?

Greed

Re: The Windows installer of ImageMagick will no longer be signed

#205

Post by entuno »

technion wrote: post #14

Just throwing in that the dollar value isn't the only cost. I've been using an automated release workflow tomanage signing, eg https://github.com/technion/rustypwneddownloader/blob/main/.... This worfklow isn't usable with these new rules, and I'm having a hard time with the assertion that moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an im…

And if it discourages people from signing their binaries at all, then that's definitely a negative outcome.

Re: The Windows installer of ImageMagick will no longer be signed

#206

Post by solarkraft »

maccard wrote: post #179
TeMPOraL wrote: post #140

Earlier quoted context omitted.

> can’t even scrape together $629 for something as essential as a software signature I don't think the $629 itself is the problem, but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Is it about security, or is it about crying "security" to push through a pay-to-play market?

> but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Putting the price aside just for a second, are there really people out there who think that code signing isn't worthwhile? Remember paint.net/filezilla having ad links to "Download Now" that would download... not paint.net or filezilla?

Yeah, me. It ensures that the binary you have is really from who it claims to be from, which can also be ensured by acquiring it through a secure channel (e.g. an HTTPS-enabled website or package repository).

It doesn't give you any guarantees about the binary being free of malware - only that it's really published by the entity you got it from.

Granted: Now an actor who wants to inject malware has to hijack the build process rather than only the website, but somehow I'm not convinced that's worth 600$/year and a lot of technical effort that could be put into securing the distribution chain.

Re: The Windows installer of ImageMagick will no longer be signed

#208

Post by hnarn »

Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

> I refuse to for a project that I already give away my time for.

Maybe I’m naive but I feel like the solution is pretty obvious: just crowdsource the cost of the certificate and only sign the software as long as the money keeps coming in.

If people really do care that much they should be willing to help shoulder the cost, and if they’re not then there shouldn’t be a problem with it being unsigned.

Re: The Windows installer of ImageMagick will no longer be signed

#209

Post by bmicraft »

Y_Y wrote: post #203
withinboredom wrote: post #149

Earlier quoted context omitted.

That is obvious. Like saying the "sun is yellow because it is about 4.5 billion years old." Even if sandboxing was thought about back when Linus was porting Unix, it would have been extremely slow as processors and ram was very limited back then. If we could go back in time and give them ridiculously fast processors and effectively unlimited ram like we have today, I'm sure Linux and Windows (er, DOS) would look quit…

The sun is white though.

White is quite a flexible term. The suns (color) temperature is 5778K.

Re: The Windows installer of ImageMagick will no longer be signed

#210

Post by kalleboo »

mikewarot wrote: post #101

Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system. GUI programs should be able to call "open" "save" and other dialogs to get handles to files, not just their names. The OS should limit access to resources to those it provides (as capability tokens) and nothing else. For CLI programs, the…

> Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system

This is how macOS works these days with sandboxing. Unless you manually go into system settings to grant "full disk access", apps only get access to files the user has manually selected (through the system open dialog, drag and drop, double-clicking, etc)

People continually decry this as "iOSification of the Mac", "the end of general purpose computing" and "too many damn permissions dialogs what is this Windows Vista or something"

Post reply on HN