Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

331–340 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#331
post #276

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…

Step one would probably be to stop the incessant shitting on everyone that suggests source available developers do, in fact, have a right to find ways to extract value out of their code, and that the OSI is probably the cause of all the funding woes. But since we’re still not past even this after YEARS, I have little faith that we’ll ever get there.

It's clearly an impassioned topic for you, but it's important to remember that your passion may be clouding your judgement.

While indeed methods exist, many problems remain, and it's useful to note that not all systems currently used may be appropriate for all creators.

Your suggestion that complaints about current solutions are invalid, implies a lack of empathy with those who aren't served by existing mechanisms. This view could come across as too one-sided, which might hamper its ability to be taken seriously.

Similarly, your comment seeks to curtaIl any critic of OSI licenses, and while it's true they provide many protections and benefits, it's also true that many new licenses and mechanisms are being used as a result of gaps in the current approach.

Failing to understand the concerns of other segments of the ecosystem with which you may not be acquainted, does not mean their complaints are without merit. You may take it as an opportunity to better grasp the realities facing creators to give you a clearer understanding of the issue overall.

Re: The Windows installer of ImageMagick will no longer be signed

#332

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…

If you frame it as “just” the money problem, you are suddenly competing with everyone who has more money, and they can surely win in that. If you frame it as “security” problem, you are already nothing compared to those who are believed to have the final say on “security”. Before you play, remember that the house always wins.

Ha! Your username is hilarious. Have you seen those cat-cucumber videos? What is up with that?? Hahaha :)

Thanks for your comment; it's certainly thought-provoking. You're advocating for a more strategic look at the challenges open source projects face, which I appreciate. Also, I like your "Socratic"-style! :)

Firstly, you mention that framing this as a "money problem" pits us against bigger players with more resources. While that's a concern, the idea that you can't succeed if you don't already have money is fundamentally flawed. Every large business started small. In the realm of open source, financial challenges aren't unsolvable; they require a new transactional approach.

On the security aspect, yes, established authorities have a stronghold, but that's not unbreakable. Look at services like Let's Encrypt, which offers free SSL certificates at scale. They emerged as a disruptor, challenging the established norms in a market that was seemingly locked down.

And to your final point, about "the house always wins," I'd say this defeatist attitude is the real obstacle. The notion that we can't or shouldn't try to change the system is harmful. You say the house always wins, but who exactly are the "insiders" here? Are we just supposed to accept the status quo, or should we aim for innovation that could make the system more equitable?

So, back to you: what solutions do you see? Or at least, what approach do you think has a fighting chance? I'm genuinely curious to hear your perspective.

Re: The Windows installer of ImageMagick will no longer be signed

#333
post #199

Earlier quoted context omitted.

It is a common source of security vulnerabilities. Also the API is has silly names, uses globals, not really nice, and not really FFI friendly (overcomplicated). Also requires global installation, cannot be deployed side by side with projects. For me it is a solid red flag for any project if they are using ImageMagick/GraphicsMagic. I don't let it near my computers.

What do you use, then? Netpbm?

Depends. libgd (has good API for FFI, van be side by side installed easily). ImageSharp (C#, very good, paid for commercial use). Sharp (JS). I use hugo's build in image tools. Sometimes a desktop app: Paint.Net. Affinity Photo. Whatever else suits my needs.

Re: The Windows installer of ImageMagick will no longer be signed

#335

Earlier quoted context omitted.

It is a common source of security vulnerabilities. Also the API is has silly names, uses globals, not really nice, and not really FFI friendly (overcomplicated). Also requires global installation, cannot be deployed side by side with projects. For me it is a solid red flag for any project if they are using ImageMagick/GraphicsMagic. I don't let it near my computers.

Too bad it is already there...

What? Where?

Re: The Windows installer of ImageMagick will no longer be signed

#336

Earlier quoted context omitted.

Performance has absolutely nothing to do with sandboxing. Heck you could already apply many sandboxing techniques with Linux 0.x by chroot() to an empty directory followed by setuid() to "nobody". If that process needs file access, fork() a broker process before the chroot() that funnels file descriptors over an unix socket to the sandboxed process. The broker strictly checks file access permissions of course or coul…

> Performance has absolutely nothing to do with sandboxing. In theory, sure. In practice, when Ubuntu added a sandbox to the calculator it started taking longer to start than Eclipse. Took them about 4 years to fix it.

More a matter of execution than the technology.

Sandboxing and virtualization existed in mainframes and micros already for decades, and were originally made available in UNIXes like Tru64 and HP-UX Vaults.

Re: The Windows installer of ImageMagick will no longer be signed

#337
post #90

Earlier quoted context omitted.

This way of working should have been left behind in the previous century. Sandboxing should be default. Associating file endings should be a suggestion to the OS, accepted by the user, not something only configurable by delegating full super admin to third party app. Slow loading context menus where every app tries to claim its presence. Thank you for reminding me why I don’t use Windows since years ago. A image edit…

> iOS, Android and the browser has proven it is possible. Whatever woes Windows's UX and design choices cause, I'd still take it a million times over any of these three terribly improductive environments

Security is coming anyway, unless you stay on old Windows versions.

"BlueHat IL 2023 - Default Security"

https://www.youtube.com/watch?v=8T6ClX-y2AE

"Modernize your Win32 application for security and privacy"

https://build.microsoft.com/en-US/sessions/d2ad7043-223f-4bb...

Re: The Windows installer of ImageMagick will no longer be signed

#338
post #90

Earlier quoted context omitted.

This way of working should have been left behind in the previous century. Sandboxing should be default. Associating file endings should be a suggestion to the OS, accepted by the user, not something only configurable by delegating full super admin to third party app. Slow loading context menus where every app tries to claim its presence. Thank you for reminding me why I don’t use Windows since years ago. A image edit…

I disagree entirely. The only reason for creating native apps is to allow apps to interoperate and integrate deeply with the OS. Apps should be free to pass data around with each other, and this absurd level of security overreach, suggesting every app should be sandboxed, is actively hurting the computing world. Sure, if you're making a game or some browser replacement, then go for sandboxing. But most productivity s…

When $HOME is exposed to the world it matters.

Re: The Windows installer of ImageMagick will no longer be signed

#339
post #247

I've been through hell and back on both Windows and MacOS with application signing. It's only getting worse. First thing I have to note is that this really makes me want to offer anything as a web app. The browser offers a much better experience in so many ways and security is a well thought out integrated experience unlike these 25 year old operating systems bolting security on as an after thought. Clearly no one at…

WASM and WebGPU are closing the performance gaps between browser and native. It's getting to the point where if it's not a device driver, it can probably be recompiled for use client-side in the browser.

Yet another bytecode runtime, as many others since the 1960's, and a GPU technology based on 2015's hardware capabilities, only supported currently by ChromeOS (nee Web).

Re: The Windows installer of ImageMagick will no longer be signed

#340
The certificate process at Microsoft is an absolute hell designed for their "authorized" sales people to generate money out of thin air.

As a result – most people now skip the "SmartScreen" warning at the level of habit. This warning just adds to the noise from the Windows system which you want to skip as fast as possible.

Tons of good software simply can't afford it or won't bother getting such a non-portable thing as hardware FIPS. Classic Microsoft "just shove it up your throat" practices for the sole purpose of revenue

Post reply on HN