231–240 of 364 posts
Earlier quoted context omitted.
Unrecognized publisher warning in blue box (not UAC) comes up no matter what the software is when trying to install or run.
Moreover, a warning pops up even for signed binaries, until that binary has been installed enough times (?) and Microsoft is satisfied.
Just throwing in that the dollar value isn't the only cost. I've been using an automated release workflow tomanage signing, eg https://github.com/technion/rustypwneddownloader/blob/main/.... This worfklow isn't usable with these new rules, and I'm having a hard time with the assertion that moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an im…
For most projects it is an improvement, for better or worse.
First issue: private keys stored in files can be stolen silently, and then the only recourse is revocation. That's the main reason for the HSM requirement: malware authors have been doing this for some time now and revocation is difficult/expensive for various reasons. An HSM can also be stolen but only in the old fashioned way of breaking into your office or home and grabbing it, which you're going to notice.
You may object that the credentials for using the HSM can be stolen, and that's true, but they can also be changed easily and quickly. So if you notice that your PIN has been keylogged, you can recover from the compromise then change the PIN and you're done, no need to revoke the certificate.
Second issue: automated signing in CI can actually be risky. It means anyone who can push code to your CI system can get code signed as yourself, possibly without you even being aware of it. The key is held online at all times, so obviously if the CI system gets hacked then it's game over, but even without that it boils down to anyone who can push code into the system becoming a weak point, especially because CI systems are running lots of arbitrary code without being closely monitored. CI signing is at best 1-factor security.
If you sign locally then the key can be (literally) offline until the moment you do a release, and access to it can be constrained via 2-factor auth: the key is something you have, the credential is something you know. So this is quite secure.
For signing nightly dev builds, internal tools and other transient binaries that shouldn't get out into the wild anyway, you can self-sign which is free.
Earlier quoted context omitted.
> but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Putting the price aside just for a second, are there really people out there who think that code signing isn't worthwhile? Remember paint.net/filezilla having ad links to "Download Now" that would download... not paint.net or filezilla?
Yeah, me. It ensures that the binary you have is really from who it claims to be from, which can also be ensured by acquiring it through a secure channel (e.g. an HTTPS-enabled website or package repository). It doesn't give you any guarantees about the binary being free of malware - only that it's really published by the entity you got it from. Granted: Now an actor who wants to inject malware has to hijack the buil…
If you can’t put $600/year into signing your binary, I don’t know how much effort you’re going to put into securing a distribution chain.
I really wish they would lower the cost of signing certificates generally. $10 tops. I can’t justify the cost for my very specialized software very few people use. My only explanation for why it needs to be so expensive is that it needs to be a large enough charge that the rightful owner of a stolen credit card might notice it? Because it’s in and of itself an author verification? If that’s the case though, they coul…
Certificates are expensive because governments aren't digitized and don't really "do" cryptography, so associating ownership of a private key with ownership of a legal identity requires a lot of manual effort. CAs have to do things like look up your registration details in country-specific websites that don't have APIs, make phone calls, study passport scans and so on. That's all very labor intensive which makes it expensive.
It could be made a lot cheaper if governments ran their own PKIs and issued every company registrant with private keys as part of setup, likewise if passports came with private keys usable for document signing (govs already run PKIs for e-Passports but you have no way to associate a personal private key with that certificate).
Unfortunately there's been no movement on that for a long time, and the few countries that did experiment with national PKIs have mostly given up. America never tried to do large scale government PKI outside of the DoD, and therefore US software firms never felt much need to do a good job of smartcard support. No mainstream operating system has solid support for it, standards are lacking, etc.
Then you have the generally high overheads that the certificate consumers (Microsoft) and CA/Browser forum mandates for CAs. That costs money too. Then the overheads that come with a company existing at all (websites, taxes, salaries etc).
The reason for the annual fee is to amortize the cost over time. It costs the CA more than the 1-year fee to issue the certificate in the first place, but if they assume you'll use it for at least a few years then they can break even then make a small profit.
Earlier quoted context omitted.
It’s a valid point you raise. Certainly conceivable. Whatever the security ramifications, however, the usability consequences are real and important. See my other comment for how i consider this may be cartel behavior: https://news.ycombinator.com/item?id=38056460
My point is slightly different. You're focusing on fees, and open source being an industry in itself. Quoting from the linked comment: > This lack of awareness hampers [open source community's] ability to participate effectively in the marketplace, including financial transactions to sustain itself. Thing is, a large part of that community doesn't want to "participate effectively in the marketplace" . The community s…
Earlier quoted context omitted.
But that's a thin line. Free certificates negate security. Instead, there are various foundations that sponsor popular open source projects for costs like signing certificates and hosting. I'm sure one of these should be trustworthy enough to obtain a signing certificate themselves so they can issue and revoke certs to various projects without much cost.
This does not solve the problem at all, and does not improve security either. Microsoft themselves could perfectly well have the same analysis in-house and provide free certificates to properly vetted projects. Adding layers of middlemen to deal with is a pain in the backside and a consequence is that some projects will just not bother. It’s inefficient on all levels and still does not protect from bad actors.
It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…
you see it as a failure of the tech industry to finance open source. I see it as a failure to provide security systems like this without the need for financial gatekeeping. $629.00 isn't a trivial amount of money.
I recently went through this same issue at my company - only found out about the change in requirements when I couldn't renew my cert at the previous provider. There is surprisingly little info available on how to do code signing for Windows now. I don't want to use a physical device - with fully remote teams it's not feasible. Eventually settled on Azure KeyVault with Digicert (I don't like Comodo aka Sectigo). Ther…
Hey, is there any chance you could do a writeup on how you did things? due to the lack of information you mention, I think it might be useful for a lot of people there, including me.
https://hydraulic.dev/blog/21-shipping-electron-apps-from-ci...