The Windows installer of ImageMagick will no longer be signed

Post by jacquesm » Sun, Oct 29, 2023, 2:55 PM UTC

matharmin wrote: post #109

I recently went through this same issue at my company - only found out about the change in requirements when I couldn't renew my cert at the previous provider. There is surprisingly little info available on how to do code signing for Windows now. I don't want to use a physical device - with fully remote teams it's not feasible. Eventually settled on Azure KeyVault with Digicert (I don't like Comodo aka Sectigo). Ther…

Post by butz » Sun, Oct 29, 2023, 3:02 PM UTC

Post by CogitoCogito » Sun, Oct 29, 2023, 3:06 PM UTC

keepamovin wrote: post #250

CogitoCogito wrote: post #92

Earlier quoted context omitted.

Have you considered volunteering to pay for and run the signing infrastructure?

There's a better way to see this: once can make a statement about the principle of the necessity of having transactions to exchange value, but not have a particular demand for the offered good or service themselves. I think that's what's going on here, so it might be better to keep these seeming "gotcha" type questions, which are irrelevant, either out of the discussion, or at least remember how they are misplaced! :…

Post by cobbal » Sun, Oct 29, 2023, 3:11 PM UTC

breakfastduck wrote: post #219

kalleboo wrote: post #210

Earlier quoted context omitted.

> Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system This is how macOS works these days with sandboxing. Unless you manually go into system settings to grant "full disk access", apps only get access to files the user has manually selected (through the system open dialog, drag and drop, dou…

Yeah I don't really understand the push back on the way they're handling it. I actually think zero trust to access the filesystem without explicit confirmation is a good thing.

Post by xrd » Sun, Oct 29, 2023, 3:16 PM UTC

safeimp wrote: post #253

xrd wrote: post #247

I've been through hell and back on both Windows and MacOS with application signing. It's only getting worse. First thing I have to note is that this really makes me want to offer anything as a web app. The browser offers a much better experience in so many ways and security is a well thought out integrated experience unlike these 25 year old operating systems bolting security on as an after thought. Clearly no one at…

Wouldn’t this be a liability though? In this scenario are you just blindly signing whatever? If yes, that’s obviously not good. The alternative is you have a long review and audit process but in the event something falls through the cracks, this still bites you.