Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

301–310 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#301

Post by xrd »

Dalewyn wrote: post #287
safeimp wrote: post #253

Earlier quoted context omitted.

Wouldn’t this be a liability though? In this scenario are you just blindly signing whatever? If yes, that’s obviously not good. The alternative is you have a long review and audit process but in the event something falls through the cracks, this still bites you.

Seeing as we're now HTTPSing everything under the sun including the malicious, I don't see the problem signing every single binary under the sun regardless malevolence.

As others have noted on this topic, HTTPS only requires knowing the domain which can be addressed using DNS records. With app signing the operating system vendors want to know you are a legitimate business which means Duns and Bradstreet number and often more, which is much more complicated to validate.

Re: The Windows installer of ImageMagick will no longer be signed

#302

Post by kenjackson »

michaelt wrote: post #256
kenjackson wrote: post #234

Earlier quoted context omitted.

$600/year buys you how much you can put into securing the distribution chain? 3 hours of dev time? If you can’t put $600/year into signing your binary, I don’t know how much effort you’re going to put into securing a distribution chain.

So you're donating $600/year to ImageMagik for them to get a code signing certificate, right? Oh, you're not? Then why should the volunteer developers do so?

I don’t use ImageMagik. I don’t care if they shutdown the whole project. But if you told me Madden was going to shutdown due to $600/year I could raise that amongst my small group of friends so that we could just play the game.

Re: The Windows installer of ImageMagick will no longer be signed

#303

Post by thenerdhead »

There is a solution here but nobody knows about it.

https://www.youtube.com/watch?v=Wi-4WdpKm5E

Also it has been 3 years since that video and even a modern search still has unclear messaging if this thing is even an option to be used today.

Looks like a dev commented in the GitHub issue, but clearly the maintainer of this project had no idea it existed.

Re: The Windows installer of ImageMagick will no longer be signed

#304

Post by TeMPOraL »

kenjackson wrote: post #302
michaelt wrote: post #256

Earlier quoted context omitted.

So you're donating $600/year to ImageMagik for them to get a code signing certificate, right? Oh, you're not? Then why should the volunteer developers do so?

I don’t use ImageMagik. I don’t care if they shutdown the whole project. But if you told me Madden was going to shutdown due to $600/year I could raise that amongst my small group of friends so that we could just play the game.

Which is exactly why I think money is not the issue here. That $600 is trivial to raise for a project this widely used, should the need arise. The issue is likely about having to pay in the first place, and the reason behind it.

Re: The Windows installer of ImageMagick will no longer be signed

#305

Post by brnt »

nolongerthere wrote: post #280
londons_explore wrote: post #182

Earlier quoted context omitted.

Hopefully Windows will remember that I downloaded the file from imagemagic.com check that the certificate matches the place I downloaded it from... Although... As long as downloads are always provided from the official domain via HTTPS, and the OS can keep track of that, I don't really see why the executable itself needs to be signed...

Most OS software is downloaded from code repositories like github or fosshub to save on networking costs, not to mention CDNs that are often used even when the link is on the software's website the file itself will often not be "coming from" that website.

> Most OS software is downloaded from code repositories like github or fosshub to save on networking costs,

[X] Doubt

Do not underestimate the sheer number of people jamming in software names or descriptions into Google and getting their wares on the likes of softpedia.

Re: The Windows installer of ImageMagick will no longer be signed

#306

Post by brnt »

__david__ wrote: post #281
microtonal wrote: post #273

Earlier quoted context omitted.

macOS by default doesn't run unsigned or incorrectly signed apps, period. Only Apple can hand out certificates and certificates are at the very least associated with payment info (though sometimes they want more, DUNS number or whatever). Signed application bundles remove many attack vectors. The primary remaining vectors are: 1. A malicious entity can sign up for a developer account. 2. A non-malicious entity's cert…

> macOS by default doesn't run unsigned or incorrectly signed apps, period. It kinda depends on what you mean by “default”, but you can always right click an app in Finder and select “open”. When you get the scary “unsigned app” pop-up there will be an extra option there to run it anyway, allowing you to run unsigned binaries without making any settings changes to the os. That said, I largely agree with the rest of y…

You only can if you are the admin on your system or enter admin credentials. I don't know, is that still the default?

Re: The Windows installer of ImageMagick will no longer be signed

#307

Post by bigboy12 »

Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

Why the f would anyone use windows with all the hassle, ads, screw overs, tracking and forced hardware updates get a Mac and don’t worry about.

Re: The Windows installer of ImageMagick will no longer be signed

#308

Post by __david__ »

brnt wrote: post #306
__david__ wrote: post #281

Earlier quoted context omitted.

> macOS by default doesn't run unsigned or incorrectly signed apps, period. It kinda depends on what you mean by “default”, but you can always right click an app in Finder and select “open”. When you get the scary “unsigned app” pop-up there will be an extra option there to run it anyway, allowing you to run unsigned binaries without making any settings changes to the os. That said, I largely agree with the rest of y…

You only can if you are the admin on your system or enter admin credentials. I don't know, is that still the default?

Maybe? It has never asked for credentials when I do that, but I’ve also never not been an admin on my computer (which is default), so I don’t know.

Re: The Windows installer of ImageMagick will no longer be signed

#309

Post by kenjackson »

TeMPOraL wrote: post #304
kenjackson wrote: post #302

Earlier quoted context omitted.

I don’t use ImageMagik. I don’t care if they shutdown the whole project. But if you told me Madden was going to shutdown due to $600/year I could raise that amongst my small group of friends so that we could just play the game.

Which is exactly why I think money is not the issue here. That $600 is trivial to raise for a project this widely used, should the need arise. The issue is likely about having to pay in the first place, and the reason behind it.

They don’t have to pay it. They don’t have to have code signed.

And what’s the issue with the reason behind it? The CA/B Forum made this decision after a lot of deliberation. What’s a better partial solution to this problem given the state of the world today?

Re: The Windows installer of ImageMagick will no longer be signed

#310

Post by eesmith »

keepamovin wrote: post #289
blueflow wrote: post #251

Earlier quoted context omitted.

I did make it for free. And i expect no recognition or profit. I did my OSS contributions for my own usecases and sharing the fruits with the public is a neat side effect. Also your hyperbole is apalling.

The only appalling hyperbole is you trying to sneakily misrepresent the above as hyperbolic! :) > I did make it for free. And i expect no recognition or profit. But you didn't make it for free. Your time is not free. The resources you use are not free. What you expect, is, to put it lightly, flexible. Your expectations change as you gain understanding and experience. Perhaps you're fond of RPGs? Like that. > I did my…

The phrase "make it for free" means the people who use or enjoy it are not expected to pay or provide other direct compensation for it. Think "make it for uncompensated use".

It does not mean that it cost nothing to make, as otherwise that phrase would have no meaning.

Yet a Google search finds people using the phrase "make it for free" for things which quick clearly require the input of personal time ("DIY Circular Saw Storage Holder (Make it for Free)"; "I'll make it for free to get experience."; "Why would a client want to pay for a website, when they can just make it for free with platforms like ..."; and "My Favorite Composting Bin; How to make it for free in minutes.")

> Plenty of businesses began the same way.

So did a huge amount of academic research projects, with funding paid for by other sources.

Post reply on HN