211–220 of 364 posts
It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…
Earlier quoted context omitted.
> can’t even scrape together $629 for something as essential as a software signature I don't think the $629 itself is the problem, but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Is it about security, or is it about crying "security" to push through a pay-to-play market?
> but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Putting the price aside just for a second, are there really people out there who think that code signing isn't worthwhile? Remember paint.net/filezilla having ad links to "Download Now" that would download... not paint.net or filezilla?
Still, if a major problem is ads directing to malware-infested downloads, how about before we start requiring OSS projects to become legal entities, we apply the same idea to advertisers? Why not introduce "ad signing", or better yet, some regulatory scheme, where you cannot provide an ad, and you cannot display an ad, unless you're a recognized legal entity with a certificate chain to back it? That would address a part of this problem at the very source (and address so, so, so many other problems too).
But I get it. We have to disempower the innovators and make it hard for honest people, because the whole computing industry makes almost all its money from scoundrels fucking the society over, and while we can't admit to it out loud, we can talk up the threat of overt bad actors, so that no one pays attention to more covert bad actors running the show.
Earlier quoted context omitted.
Will you notice if the software will be signed by certificate for "imagemaqick.com" or "imagemagik.com" or "imagemagick-developers.com"?
Hopefully Windows will remember that I downloaded the file from imagemagic.com check that the certificate matches the place I downloaded it from... Although... As long as downloads are always provided from the official domain via HTTPS, and the OS can keep track of that, I don't really see why the executable itself needs to be signed...
imagemagic.com
That's a good way to illustrate the GP's point.
As long as downloads are always provided from the official domain via HTTPS
You are conflating control over the public website with control over the build/signing infrastructure. A good defense-in-depth strategy means that a compromise of one should not lead to an automatic compromise of the other.
Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system. GUI programs should be able to call "open" "save" and other dialogs to get handles to files, not just their names. The OS should limit access to resources to those it provides (as capability tokens) and nothing else. For CLI programs, the…
So, a music player that keeps a database on 25000+ files needs to hold and manage 25000+ capability tokens? Do I have to select all those files in an "Open" dialog box? Hell naw, dawg.
> ”Digicert seems to be our only option now but a certificate there would cost $629 (tax excluded) for a single year.” Yikes! At least Mac (and iOS) developers get this for $99/year. What makes code signing so expensive on Windows?
The longer I live, the more I realize RMS is a modern Cassandra.
It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…
If you frame it as “security” problem, you are already nothing compared to those who are believed to have the final say on “security”.
Before you play, remember that the house always wins.
Earlier quoted context omitted.
Because domain names are cheap and can be purchased in bulk. TLS certificates are for encryption. You don't care if the endpoint is "bad" in some way, only that you are communicating with it securely. Code signing certificates are to make bans stick. Totally different purpose.
Companies aren't cheap, but they aren't exactly expensive either. A couple weeks ago I've registered a company in Estonia – it only cost me the 265 € state fee. Code signing certificate is another what, 500 euro on top of that? Certainly more expensive than a $10 domain with a free certificate, but still could be a reasonable cost for e. g. a targeted attack. There's another catch – you either have to register a comp…
Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system. GUI programs should be able to call "open" "save" and other dialogs to get handles to files, not just their names. The OS should limit access to resources to those it provides (as capability tokens) and nothing else. For CLI programs, the…
> Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system This is how macOS works these days with sandboxing. Unless you manually go into system settings to grant "full disk access", apps only get access to files the user has manually selected (through the system open dialog, drag and drop, dou…
Earlier quoted context omitted.
The sun is white though.
White is quite a flexible term. The suns (color) temperature is 5778K.