Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

341–350 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#341

Post by rat9988 »

sime2009 wrote: post #314
rat9988 wrote: post #260

Earlier quoted context omitted.

Because Ms hasn't asked for it.

Of course MS asked for it. They created and sustain this situation where software needs to signed for it to easily run on the Windows platform. Who do you think put the signature checking code and root keys in Windows?? The code signing gnomes?? fairies??

They didn't ask for ImageMagick. Would they have asked ImageMagick to develop the software for their platform to enrich it, I would have agreed that they should pay. Otherwise anyone can say I enrich your ecosystem so pay me.

Re: The Windows installer of ImageMagick will no longer be signed

#342

Post by gloosx »

electroly wrote: post #121
veeti wrote: post #119

Earlier quoted context omitted.

You don't need a HSM, just a HSM backed key. It costs like $5 a month.

Can you point me at some more information about the difference? This would seem to be a much better deal than paying Digicert, but I'm confused about how it can be so cheap? Isn't the required for an HSM at all the reason it's so much more expensive now at other CAs?

This whole thing is set-up to earn your money under the cover of protecting somebody from something, so all the prices you see are random manager thoughts on how much they want to get.

There is no reasoning behind this price really and it is just arbitrary price made from rules "as high as possible" and "low enough they still buy from us". Microsoft certificate prices are essentially like drug prices, and the "authorized resellers" is basically a drug cartel

Re: The Windows installer of ImageMagick will no longer be signed

#343

Post by gloosx »

vasdae wrote: post #111
rand846633 wrote: post #62

Earlier quoted context omitted.

It’s also not clear why the IM project should be paying MS and not the other way round…

MS does not sell certificates.

The cartel leaders don't sell drugs, street pushers do.

MS just have to sell licenses to sell certificates.

Re: The Windows installer of ImageMagick will no longer be signed

#344

Post by ogurechny »

keepamovin wrote: post #332
ogurechny wrote: post #217

Earlier quoted context omitted.

If you frame it as “just” the money problem, you are suddenly competing with everyone who has more money, and they can surely win in that. If you frame it as “security” problem, you are already nothing compared to those who are believed to have the final say on “security”. Before you play, remember that the house always wins.

Ha! Your username is hilarious. Have you seen those cat-cucumber videos? What is up with that?? Hahaha :) Thanks for your comment; it's certainly thought-provoking. You're advocating for a more strategic look at the challenges open source projects face, which I appreciate. Also, I like your "Socratic"-style! :) Firstly, you mention that framing this as a "money problem" pits us against bigger players with more resour…

I didn't mean that you “can't succeed” or “can't win”. You can, but the process itself silently changes, and you are now playing by others' rules instead of your own, and get concerned with goals that are different from the original. The idea that you need to “succeed” or “win” itself is something others told you.

Power does not always come with fear, it can be unnoticeable or hidden inside candy wrapping. An existing person does not exist to corporate/government structures without official papers proving it. In the same manner, users can't access many modern services without social network account or mobile phone number (which is a qualified long term tracking id which allows these services to find their place in existing data trading schemes). Smartphones essentially belong to platform owners which merely allow consumers, hardware, and application makers to use their services. The problem is not whether “A is good” or “B is bad”, the problem is giving those abilities to decide to some entity, which people do voluntary.

The idea is that you shouldn't play with a swindler at all if you understand that it's a swindle, even if inertia or goading makes it the easier choice.

Re: The Windows installer of ImageMagick will no longer be signed

#345

Post by WhrRTheBaboons »

Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

cool project!

Re: The Windows installer of ImageMagick will no longer be signed

#346

Post by fsflover »

mikewarot wrote: post #330
fsflover wrote: post #158

Earlier quoted context omitted.

You may be interested in trying Qubes OS, which provides security through compartmentalization: https://qubes-os.org

Nope... I'm waiting for Genode to get to the point where I can use it as a daily driver... or GNU Hurd. Sandboxes and containers are what you do when you don't have proper capability models to utilize. I'll keep putting up with Win10 or Linux until I get that.

> Sandboxes and containers are what you do when you don't have proper capability models

There is no better security than through compartmentalization. The other approaches are through obscurity (doesn't work at all) or correctness (unrealistic). Also, compare the number of CVEs of Qubes and any other system.

Re: The Windows installer of ImageMagick will no longer be signed

#347

Post by Rebelgecko »

bigboy12 wrote: post #307
Rodeoclash wrote: post #39

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

Why the f would anyone use windows with all the hassle, ads, screw overs, tracking and forced hardware updates get a Mac and don’t worry about.

I dont think any of the games the project lists even work on Mac (CS:GO used to but the latest versions don't)

Re: The Windows installer of ImageMagick will no longer be signed

#348

Post by AnthonyMouse »

mike_hearn wrote: post #228
notpushkin wrote: post #192

Earlier quoted context omitted.

Companies aren't cheap, but they aren't exactly expensive either. A couple weeks ago I've registered a company in Estonia – it only cost me the 265 € state fee. Code signing certificate is another what, 500 euro on top of that? Certainly more expensive than a $10 domain with a free certificate, but still could be a reasonable cost for e. g. a targeted attack. There's another catch – you either have to register a comp…

Yeah and now that person who you paid to register it in your name rats you out to the police. Also, there are a lot of laws you can end up breaking with severe penalties in the course of trying to hide your identity for company registration purposes (it enters the world of anti-money laundering). It's harder than it sounds, which is why malware authors prefer to steal keys than set up fake companies. Hence the new ha…

> Yeah and now that person who you paid to register it in your name rats you out to the police.

But they don't know who you are, because you're a scammer who is lying to everyone including them.

> Also, there are a lot of laws you can end up breaking with severe penalties in the course of trying to hide your identity for company registration purposes (it enters the world of anti-money laundering).

So is credit card fraud or CFAA violations, which is the thing this is ostensibly to prevent. Criminals don't follow laws.

> It's harder than it sounds, which is why malware authors prefer to steal keys than set up fake companies. Hence the new hardware requirements.

It's not actually that hard, it's just that stealing keys is really easy. And it's not obvious that the new hardware requirements are going to do any good, because that type of consumer hardware has been consistently riddled with vulnerabilities -- Intel essentially gave up on SGX because they couldn't make it work.

Re: The Windows installer of ImageMagick will no longer be signed

#349

Post by keepamovin »

midasuni wrote: post #320
keepamovin wrote: post #249

Earlier quoted context omitted.

"Freedom for whom?" For the developers whose time they invested. For the users who are not "free" of their problems that prompt them to see these "free" solutions? Nothing about OSS is free. "Free" is a lie. Pernicious, in that it was passed off under the guise of some ideal, yet it undermines the long term sustainability of the field by supporting a sense of entitlement.

Free means you are not imposing restrictions on me, and I am not imposing restrictions on you.

That's one way to look at it. But there are multiple paths. Best to not limit to one direction and pretend that's the only way. That's the trap of quoting "FS" orthodoxy, which only clouds judgement.

Re: The Windows installer of ImageMagick will no longer be signed

#350

Post by keepamovin »

eesmith wrote: post #311
keepamovin wrote: post #249

Earlier quoted context omitted.

"Freedom for whom?" For the developers whose time they invested. For the users who are not "free" of their problems that prompt them to see these "free" solutions? Nothing about OSS is free. "Free" is a lie. Pernicious, in that it was passed off under the guise of some ideal, yet it undermines the long term sustainability of the field by supporting a sense of entitlement.

You are getting tangled up by the two different meaning of the word "free". Quoting https://www.gnu.org/philosophy/free-sw.en.html > “Free software” means software that respects users' freedom and community. Roughly, it means that the users have the freedom to run, copy, distribute, study, change and improve the software. Thus, “free software” is a matter of liberty, not price. To understand the concept, you should t…

No, I am not tangled in it, I'm aware of it. I think you may be tangled in "free software" orthodoxy tho, and confused by it! :)

Moreover, I am reflecting the confusion between free as in price-free and free as in restriction-free in the original comment. Ergo: "FS is about freedom" suggests restriction-free. "Not paying rent" suggests price-free.

I am also suggesting the FS dogma is deceptive, and clouds the issue. You will do well to think more deeply of these things, instead of simply quoting from a FS site.

Please go back and read my original comments to which you are replying. The meaning may be in there to set you free from this! :)

Post reply on HN