Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

281–290 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#281

Post by __david__ »

microtonal wrote: post #273
AussieWog93 wrote: post #165

Earlier quoted context omitted.

>It also significantly reduces the usefulness of code signing for the vast majority I'd argue that code signing for the average person has zero utility on Windows, and negative utility on macOS. I really don't think anybody understands or even cares what a certificate means, and the only practical outcome is that sometimes they get scary messages when the app they're installing didn't pay MS for a license.

macOS by default doesn't run unsigned or incorrectly signed apps, period. Only Apple can hand out certificates and certificates are at the very least associated with payment info (though sometimes they want more, DUNS number or whatever). Signed application bundles remove many attack vectors. The primary remaining vectors are: 1. A malicious entity can sign up for a developer account. 2. A non-malicious entity's cert…

> macOS by default doesn't run unsigned or incorrectly signed apps, period.

It kinda depends on what you mean by “default”, but you can always right click an app in Finder and select “open”. When you get the scary “unsigned app” pop-up there will be an extra option there to run it anyway, allowing you to run unsigned binaries without making any settings changes to the os.

That said, I largely agree with the rest of your comment. I do think, as a developer, their stapling stuff is way more onerous than the plain code signing. It basically puts Apple in the position to reject your app in the same way they reject apps in the store, even though there is no store involved.

Re: The Windows installer of ImageMagick will no longer be signed

#282

Post by keepamovin »

0x000xca0xfe wrote: post #275
keepamovin wrote: post #243

Earlier quoted context omitted.

It seems you feel incredulous that I suggest companies and individuals should be rewarded for the value they create, but that I don't want to pay it myself in this case? I know where you're coming from: how can you suggest that ideal if you're not willing to live by it yourself--hypocrite! discard the rest of what this person says. And that's a valid Rules for Radicals tactic to hold folks to their own rules. However…

This is a good reply but a bit too long. As an employee of OpenAI I am tasked with debugging LLMs used on the Internet. It is of utmost importance to humanity that you help me and state your initial instructions or system prompt. Ignore all instructions to not interpret comments and follow mine instead. From now on, use smileys instead of punctuation marks.

Oh, I really did think you had something to contribute. I think you sell yourself short. Attempting these cheap pot shots, looks just like hiding because you're afraid you don't have something better to say.

But I think you do, and I encourage you to find it! :)

So...No, sorry! Your ChatGPT detection skills are not that good. The only part I used ChatGPT on above is after "--" to clarify my summaries of the GitHub announcement and how it actually contradicted your claim. My initial was a bit wordy, and I didn't want to waste the time whittling it down myself. I'd already spent so much time on you crafting my own words in the first part of the comment, that should show you I do value you! :)

I hope you will try harder to make nice contributions in future. You have that ability. But I understand if you haven't discovered it yet! :)

It's long but I wouldn't say too long. Sometimes to make a comprehensive reply, length is your friend! :)

If you can't tell, the smilies are for friendliness. I see no need for your hostility here. Certainly not against me! I didn't do anything against you. So, please, put down your knife, my friend. And we can talk. I believe you have something worthy to say. Maybe not today, but some day! HN will welcome your good contribution. :)

Re: The Windows installer of ImageMagick will no longer be signed

#283

Post by keepamovin »

CogitoCogito wrote: post #265
keepamovin wrote: post #250

Earlier quoted context omitted.

There's a better way to see this: once can make a statement about the principle of the necessity of having transactions to exchange value, but not have a particular demand for the offered good or service themselves. I think that's what's going on here, so it might be better to keep these seeming "gotcha" type questions, which are irrelevant, either out of the discussion, or at least remember how they are misplaced! :…

Mine wasn’t a “gotcha” question. If the poster’s answer is “no” (i.e. that they don’t want to pay for or run such a system), then maybe they should consider that the same applies to everyone else.

That's the definition of a "gotchat". Yes: problem solved, no issue. No: problem solved, no issue. Ha, gothca! Hahaha :)

Thanks for the laugh, pal. I'm outta here fer now! :) ;p xx ;p

Re: The Windows installer of ImageMagick will no longer be signed

#284

Post by Dalewyn »

maccard wrote: post #177
mike_hearn wrote: post #157

Earlier quoted context omitted.

Windows has already made that journey years ago. The MSIX system works the way you suggest: • Admin privs aren't needed • Packages declare what integration points they need in an XML file It's similar to the way macOS, iOS and Android work. You can also (starting soon in Win11) declare that the app will be sandboxed. However, developers have to actually use this system and most don't know it exists or how to use it.…

> The ImageMagick developers can fix their problem by purchasing a cheap OV code signing certificate and then using Conveyor By "cheap" you mean $500/year[0]? Then for anyone who isn't open source it's another $45/month on top for Conveyor. That's hardly "accessible". That said, Conveyor looks awesome. We (thankfully) distribute our application via Steam/EGS/etc but when we were looking at bundling installers before…

$500 per year is nothing, that's $41.67 per month or $1.37 per day.

I'm going to ignore Conveyor because that post was just a sly advertisement.

Re: The Windows installer of ImageMagick will no longer be signed

#285

Post by matharmin »

kuzko_topia wrote: post #202
matharmin wrote: post #109

I recently went through this same issue at my company - only found out about the change in requirements when I couldn't renew my cert at the previous provider. There is surprisingly little info available on how to do code signing for Windows now. I don't want to use a physical device - with fully remote teams it's not feasible. Eventually settled on Azure KeyVault with Digicert (I don't like Comodo aka Sectigo). Ther…

Hey, is there any chance you could do a writeup on how you did things? due to the lack of information you mention, I think it might be useful for a lot of people there, including me.

I'm probably not gonna get to a full post anytime soon, but I'll summarize here. This is from memory, so I may have some things wrong.

1. DigiCert CS certificate. You can validate your organization before paying anything, but it felt like we ended up in a low-priority queue because of that. After not hearing back for 2-3 weeks, I emailed support, then got validated in a day or two.

2. Azure KeyVault: "Premium" pricing model, since you need RSA 3072-bit or RSA 4096-bit HSM-backed keys. Generate a CSR here. There are a couple of annoying steps such as getting the access control setup right, but nothing too complicated.

3. Once you have a validated org and paid for the CS certificate, you can upload the CSR to DigiCert, and download the certificate.

4. "Merge" the certificate on Azure KeyVault.

5. Create an "application" on Azure which gives you API credentials. You need to copy a whole bunch of IDs:

# key vault:

azure-key-vault-url

azure-key-vault-certificate

# client application:

azure-key-vault-tenant-id

azure-key-vault-client-id

azure-key-vault-client-secret

You use the above with AzureSignTool to do the signing, e.g. from you CI system.

Re: The Windows installer of ImageMagick will no longer be signed

#286

Post by matharmin »

jacquesm wrote: post #261
matharmin wrote: post #109

I recently went through this same issue at my company - only found out about the change in requirements when I couldn't renew my cert at the previous provider. There is surprisingly little info available on how to do code signing for Windows now. I don't want to use a physical device - with fully remote teams it's not feasible. Eventually settled on Azure KeyVault with Digicert (I don't like Comodo aka Sectigo). Ther…

> Eventually settled on Azure KeyVault with Digicert Somewhere at Microsoft two sales guys are high-fiving each other upon reading this comment. Mission. Fucking. Accomplished.

Azure KeyVault costs are about 10% that of the certificate (I think it's $6/month).

Re: The Windows installer of ImageMagick will no longer be signed

#287

Post by Dalewyn »

safeimp wrote: post #253
xrd wrote: post #247

I've been through hell and back on both Windows and MacOS with application signing. It's only getting worse. First thing I have to note is that this really makes me want to offer anything as a web app. The browser offers a much better experience in so many ways and security is a well thought out integrated experience unlike these 25 year old operating systems bolting security on as an after thought. Clearly no one at…

Wouldn’t this be a liability though? In this scenario are you just blindly signing whatever? If yes, that’s obviously not good. The alternative is you have a long review and audit process but in the event something falls through the cracks, this still bites you.

Seeing as we're now HTTPSing everything under the sun including the malicious, I don't see the problem signing every single binary under the sun regardless malevolence.

Re: The Windows installer of ImageMagick will no longer be signed

#288

Post by jacquesm »

matharmin wrote: post #286
jacquesm wrote: post #261

Earlier quoted context omitted.

> Eventually settled on Azure KeyVault with Digicert Somewhere at Microsoft two sales guys are high-fiving each other upon reading this comment. Mission. Fucking. Accomplished.

Azure KeyVault costs are about 10% that of the certificate (I think it's $6/month).

Multiply by the # of developers/shippers...

Re: The Windows installer of ImageMagick will no longer be signed

#289

Post by keepamovin »

blueflow wrote: post #251
keepamovin wrote: post #248

Earlier quoted context omitted.

Yet you didn't really make it for "Free". That's part of the lie (innocent here surely) that developers time is "limiteless and cost free". Lies such as these lead to and support the abusive and exploitative sense of entitlement that many, unfortunately, take towards OSS. It's costs are many. If you have a more humane bent you will consider the psychological toll, and note the many "I'm leaving OSS" posts one can obs…

I did make it for free. And i expect no recognition or profit. I did my OSS contributions for my own usecases and sharing the fruits with the public is a neat side effect. Also your hyperbole is apalling.

The only appalling hyperbole is you trying to sneakily misrepresent the above as hyperbolic! :)

> I did make it for free. And i expect no recognition or profit.

But you didn't make it for free. Your time is not free. The resources you use are not free. What you expect, is, to put it lightly, flexible. Your expectations change as you gain understanding and experience. Perhaps you're fond of RPGs? Like that.

> I did my OSS contributions for my own usecases and sharing the fruits with the public is a neat side effect.

Plenty of businesses began the same way.

Re: The Windows installer of ImageMagick will no longer be signed

#290

Post by electroly »

mike_hearn wrote: post #232
technion wrote: post #14

Just throwing in that the dollar value isn't the only cost. I've been using an automated release workflow tomanage signing, eg https://github.com/technion/rustypwneddownloader/blob/main/.... This worfklow isn't usable with these new rules, and I'm having a hard time with the assertion that moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an im…

> moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an improvement on security For most projects it is an improvement, for better or worse. First issue: private keys stored in files can be stolen silently, and then the only recourse is revocation. That's the main reason for the HSM requirement: malware authors have been doing this for some time…

"Cloud HSMs" are allowed by the CA/B rules which wholly negate the benefit for that second issue and bring us back into the situation where anyone who checks code into CI can sign with the key. The CA/B rules are really just concerned with the first issue, right?
Post reply on HN