Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

251–260 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#251

Post by blueflow »

keepamovin wrote: post #248
blueflow wrote: post #184

Earlier quoted context omitted.

... having to pay $629 just to ship a thing you made for free? I refuse to accept this as a normal thing to do. Microsoft inflicted this upon the Windows ecosystem themselves.

Yet you didn't really make it for "Free". That's part of the lie (innocent here surely) that developers time is "limiteless and cost free". Lies such as these lead to and support the abusive and exploitative sense of entitlement that many, unfortunately, take towards OSS. It's costs are many. If you have a more humane bent you will consider the psychological toll, and note the many "I'm leaving OSS" posts one can obs…

I did make it for free. And i expect no recognition or profit. I did my OSS contributions for my own usecases and sharing the fruits with the public is a neat side effect.

Also your hyperbole is apalling.

Re: The Windows installer of ImageMagick will no longer be signed

#252

Post by michaelt »

nolist_policy wrote: post #167
withinboredom wrote: post #149

Earlier quoted context omitted.

That is obvious. Like saying the "sun is yellow because it is about 4.5 billion years old." Even if sandboxing was thought about back when Linus was porting Unix, it would have been extremely slow as processors and ram was very limited back then. If we could go back in time and give them ridiculously fast processors and effectively unlimited ram like we have today, I'm sure Linux and Windows (er, DOS) would look quit…

Performance has absolutely nothing to do with sandboxing. Heck you could already apply many sandboxing techniques with Linux 0.x by chroot() to an empty directory followed by setuid() to "nobody". If that process needs file access, fork() a broker process before the chroot() that funnels file descriptors over an unix socket to the sandboxed process. The broker strictly checks file access permissions of course or coul…

> Performance has absolutely nothing to do with sandboxing.

In theory, sure.

In practice, when Ubuntu added a sandbox to the calculator it started taking longer to start than Eclipse. Took them about 4 years to fix it.

Re: The Windows installer of ImageMagick will no longer be signed

#253

Post by safeimp »

xrd wrote: post #247

I've been through hell and back on both Windows and MacOS with application signing. It's only getting worse. First thing I have to note is that this really makes me want to offer anything as a web app. The browser offers a much better experience in so many ways and security is a well thought out integrated experience unlike these 25 year old operating systems bolting security on as an after thought. Clearly no one at…

Wouldn’t this be a liability though? In this scenario are you just blindly signing whatever? If yes, that’s obviously not good. The alternative is you have a long review and audit process but in the event something falls through the cracks, this still bites you.

Re: The Windows installer of ImageMagick will no longer be signed

#254

Post by keepamovin »

TeMPOraL wrote: post #170
keepamovin wrote: post #166

Earlier quoted context omitted.

Thanks for your comprehensive response. I consider these topics deeply important, and worthy of a lot of consideration. I sensed we had a disagreement but likely tried to side step that to avoid any conflict, because I don’t really want to engage in that online. I’m glad to see I was right with my instinct and thank you for elaborating further just what any disagreement might be there! :) Please allow me some time to…

Thanks :). To be clear, I think what you wrote is true as well - it's a part of a larger picture. In my replies, I want to point at another part of that same picture, one I saw is not talked about at all in this thread, and which I believe may be more relevant to this case (because let's be honest, $629 for a project this widely used is peanuts, so it can't be the whole issue).

But maybe it is the issue. The guy is asking for money. He's not mounting a refusal of the whole system of signing. Everything in his announcement is about finding ways to accommodate himself to the new situation of having a certificate after a previous sponsor churned. His hesitation is clear, but a certificate there would cost $629 (tax excluded) for a single year, and his ask for sponsors is also very clear, and follows immediately: If your organization requires a signed installer then please consider sponsoring us with a code signing certificate. Please reach out to @dlemstra for questions or in case of a sponsorship.

I understand the points you are making, but instead I think in this case it is not I who is missing the larger picture, but you--missing the larger picture, and one painted clearly in the text of the GitHub announcement this thread is about.

However, in your other less relevant comment above, you raise interesting points which I want to address! While not as relevant to the specific case at hand, they are interesting and deep! Let's dive in over there! :)

Re: The Windows installer of ImageMagick will no longer be signed

#255

Post by tzs »

Reason077 wrote: post #175

> ”Digicert seems to be our only option now but a certificate there would cost $629 (tax excluded) for a single year.” Yikes! At least Mac (and iOS) developers get this for $99/year. What makes code signing so expensive on Windows?

The $629/year is if they use a certificate from one particular company (Digicert) that manages keys in a way that would be easiest for them to fit into their current workflow.

There are other options that would require more changes to their workflow but are much less expensive. See the responses on GitHub or the other comments here for several of them.

Re: The Windows installer of ImageMagick will no longer be signed

#256

Post by michaelt »

kenjackson wrote: post #234
solarkraft wrote: post #206

Earlier quoted context omitted.

Yeah, me. It ensures that the binary you have is really from who it claims to be from, which can also be ensured by acquiring it through a secure channel (e.g. an HTTPS-enabled website or package repository). It doesn't give you any guarantees about the binary being free of malware - only that it's really published by the entity you got it from. Granted: Now an actor who wants to inject malware has to hijack the buil…

$600/year buys you how much you can put into securing the distribution chain? 3 hours of dev time? If you can’t put $600/year into signing your binary, I don’t know how much effort you’re going to put into securing a distribution chain.

So you're donating $600/year to ImageMagik for them to get a code signing certificate, right?

Oh, you're not? Then why should the volunteer developers do so?

Re: The Windows installer of ImageMagick will no longer be signed

#257

Post by whywhywhywhy »

I ship a piece of free macOS software based on pyinstaller. Literally include a script to bypass the signing for the entire folder to get around having to pay.

It’s bad practice. Confusing for users and dangerous for users to get used to doing something like that.

But yeah I’m not paying $99 a year.

Re: The Windows installer of ImageMagick will no longer be signed

#258

Post by mike_hearn »

woodruffw wrote: post #74
stop50 wrote: post #70

Earlier quoted context omitted.

There is no institution like the CA/B Forum. Everyone uses their certs.

There are plenty of other certificate profiles besides CABF, but that’s besides the point. My actual question was whether Autheticode is actually requiring the CABF BRs for OV certificates, or whether there was some arbitrary CA-side policy change.

Yes CA/B Forum sets policies for Windows code signing certs and CAs just follow, even in cases where it's harmful to their customers or obviously dysfunctional :(

CA/B Forum and its members are ignored by Apple and for good reasons. They run their own PKI which is a lot easier to use and cheaper.

Re: The Windows installer of ImageMagick will no longer be signed

#259

Post by jacquesm »

xrd wrote: post #247

I've been through hell and back on both Windows and MacOS with application signing. It's only getting worse. First thing I have to note is that this really makes me want to offer anything as a web app. The browser offers a much better experience in so many ways and security is a well thought out integrated experience unlike these 25 year old operating systems bolting security on as an after thought. Clearly no one at…

I've gone through exactly that decision tree for Pianojacq and even though it made a lot of stuff much harder (notably: database work) I'm really happy with the result and apparently so are the users. Funny thing: I recently had someone tip me off to start using it :) They were quite surprised I was the main author.
Post reply on HN