Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

351–360 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#351

Earlier quoted context omitted.

You are getting tangled up by the two different meaning of the word "free". Quoting https://www.gnu.org/philosophy/free-sw.en.html > “Free software” means software that respects users' freedom and community. Roughly, it means that the users have the freedom to run, copy, distribute, study, change and improve the software. Thus, “free software” is a matter of liberty, not price. To understand the concept, you should t…

No, I am not tangled in it, I'm aware of it. I think you may be tangled in "free software" orthodoxy tho, and confused by it! :) Moreover, I am reflecting the confusion between free as in price-free and free as in restriction-free in the original comment. Ergo: "FS is about freedom" suggests restriction-free. "Not paying rent" suggests price-free. I am also suggesting the FS dogma is deceptive, and clouds the issue.…

FS dogma says you should charge as much as you want, in order to recoup the costs of developing free software.

That Microsoft wants to turn freeholder software developers into sharecroppers doesn't affect what "free software" means.

Re: The Windows installer of ImageMagick will no longer be signed

#352

Earlier quoted context omitted.

The only appalling hyperbole is you trying to sneakily misrepresent the above as hyperbolic! :) > I did make it for free. And i expect no recognition or profit. But you didn't make it for free. Your time is not free. The resources you use are not free. What you expect, is, to put it lightly, flexible. Your expectations change as you gain understanding and experience. Perhaps you're fond of RPGs? Like that. > I did my…

The phrase "make it for free" means the people who use or enjoy it are not expected to pay or provide other direct compensation for it. Think "make it for uncompensated use". It does not mean that it cost nothing to make, as otherwise that phrase would have no meaning. Yet a Google search finds people using the phrase "make it for free" for things which quick clearly require the input of personal time ("DIY Circular…

It seems your point is that I misunderstand the meaning and my dispute is thus invalid. Let's dive in, but first address your point about projects.

It’s true that academic projects begin like that, too, but if you want to turn them into businesses you have to think about business aspects. Google for example, with ads: that started as an academic project.

Regarding your point about meanings, the more common English usage of the quoted phrase is to signify the meaning: “creation had zero cost”, as indicated by your Google search.

In English, the more common way to convey the meaning “a product with zero price”, is, “It’s free”.

To conclude, while it seems your point is that I misunderstand the meaning and therefore my dispute is invalid, it also seems true that it is your interpretation which goes against the common usage. Could you be be deliberately misinterpreting simply to create a disagreement, or is it accidental?

In any case, it’s hard to argue that it's my point which is invalid. Instead, it looks as if your attempt to discredit my point by misrepresenting its meaning is the only invalid thing here.

Re: The Windows installer of ImageMagick will no longer be signed

#353

Earlier quoted context omitted.

That's the definition of a "gotchat". Yes: problem solved, no issue. No: problem solved, no issue. Ha, gothca! Hahaha :) Thanks for the laugh, pal. I'm outta here fer now! :) ;p xx ;p

I don’t understand what you’re trying to say here, but I’m glad you could at least have a laugh.

Really? It means the way you defined it, there are only two possibilities, and both make you right. So it's a "gotcha", and it's false.

Sorry for the typo! If that tripped you up I get it :)

Re: The Windows installer of ImageMagick will no longer be signed

#354

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…

It’s also not clear why the IM project should be paying MS and not the other way round…

Yeah, I mean people should definitely be paying ImageMagick. Or perhaps it's more true to say, "ImageMagick should definitely figure out a way to become a business."

Re: The Windows installer of ImageMagick will no longer be signed

#355

Earlier quoted context omitted.

Ha! Your username is hilarious. Have you seen those cat-cucumber videos? What is up with that?? Hahaha :) Thanks for your comment; it's certainly thought-provoking. You're advocating for a more strategic look at the challenges open source projects face, which I appreciate. Also, I like your "Socratic"-style! :) Firstly, you mention that framing this as a "money problem" pits us against bigger players with more resour…

I didn't mean that you “can't succeed” or “can't win”. You can, but the process itself silently changes, and you are now playing by others' rules instead of your own, and get concerned with goals that are different from the original. The idea that you need to “succeed” or “win” itself is something others told you. Power does not always come with fear, it can be unnoticeable or hidden inside candy wrapping. An existin…

Not necessarily. Part of playing is you can play by the rules you want to play. I consider that part of winning.

Or, if you want to step back and be more expansive: discard the outcome; it's part of playing well.

> The idea that you need to “succeed” or “win” itself is something others told you.

Not for me. I don't do things because others told me. I do them because I choose. Whatever I choose-winning, succeeding or whatever--it's a self-directed expression of me. I'm self-directed.

I get if it's different for you. It certainly can be like that. It can be used to manipulate.

Indeed power can be coercive and deceptive. It can be the frame, that looks desirous, or acceptable, but is actually disempowering for those who may choose to participate.

Such as "FS" ideology: seems noble, but can be misused. Such as to convince creators that it's noble that they shouldn't charge, in order to keep software cost-free.

I agree with you about the hidden power of platforms, institutions and systems. It's important for persons to be aware of these powers if they are to navigate them.

I understand the integrity of not playing with the "swindler", in this case the "signature vendor". However, that choice may become idealistic when practically your customers are prevented from having an easy install process because you are too ethical to "play" with, or pay, the "swindler".

Whether something is a swindle can depend on some point of view. The utility of creator verification is undeniable and is of benefit to users of the platform, system, institution. However, the precise value of that utility and benefit is harder to pin down, unlikely to be what the market currently charges and most probably exaggerated.

In short, looked at from one way, a costly convenience is a swindle, but from a more practical viewpoint, it's merely a cost of doing business.

And in many ways, you can choose what you care about. Pick your battles. Stand at the gate and fight the gatekeeper because of the high cover charge? Or get in side and fight the market? Choice is yours. Keep in mind that self-imposed exile of such puritanism could be used as an excuse to avoid the possible failure of real competition. It may be you think you are free, but in fact perhaps you're just afraid to fail. So, instead, you pick a fight with the doorman, so you never have to get inside and really get tested.

In conclusion, a refusal to be intimate with any swindles at all could be seen as a form of puritanism, the cost of which may be a kind of "modern exile". And I don't think it's easy to get deliveries of cucumbers to your off-grid shack in the woods! You could grow your own tho, but you'd still kind of be a modern exile, tho! Hahaha :)

Re: The Windows installer of ImageMagick will no longer be signed

#356

It’s astonishing that a project as critical and widely used as ImageMagick can’t even scrape together $629 for something as essential as a software signature. It’s a glaring example of how the tech industry fails to financially support the very open-source projects that it relies so heavily upon. Despite offering incredible value, these projects often can’t capture enough of it to sustain themselves. It’s a sobering…

I have a point I wish to add that doesn't neatly fit in reply to anyone else, so I'll just reply myself, here:

Restricting the meaning of the word "free" to one defined by "FS" orthodoxy, is very not free, wouldn't you agree? Haha :)

Indeed the word free has many meanings, and consequently care must be taken to avoid confusion. Defining free in a way that only aligns with a particular ideology may be seen as self-serving, or confusing and deceptive. It's important to avoid such biases in order to clearly examine the real issues.

It's understandable, given the dependency of big business on price-free software, that business would not want the "price-free" nature of much software to change. A "price awakening" among creators would directly threaten the bottom lines of these companies. Unfortunately, it seems they are also abusing the ideology of "FS" to create confusing false notions of a "noble software creators who gives away their creations without extracting any money". This is abusive, and exploitative, and it must stop. The way it will stop will be creators waking up. The way they will wake up will be thinking clearly, not simply subjugating themselves to, or repeating, misapplications of "FS" ideology.

Specifically, my commentary here seeks to expose the costs that occur throughout the lifecycle of software creation, and avoid the confusing false equivalences with "FS" ideology. It is by hiding or ignoring those costs that exploitation of creators is permitted to flourish. Training creators to think in ways that do not account costs to their time, or to their creations, or, that make it unacceptable to do so, is abusive. It's a gaslighting mindset that seeks to prevent creators from capturing the value they have a right to.

It's important to avoid deliberately misusing the idealism of a "FS" movement to suggest money should not be exchanged, as this is abusive to creators.

Deliberate blurring of meanings, and the creation of false equivalences and reductions, is deceptive tactic is designed to confuse in order to prevent clear understanding of the issues. This in turn can hamper people asserting their right. In this context, the ideology of the "FS" movement, is often used to create a confusing equivalence with price-free. This in turn suggests there virtue in not requesting payment for software. Overall, this abuse of "FS" ideology is done in order to continue to exploit creators.

In short, the very ideology of freedom you tout is abused as to restrict creators, and oppress their right to financial self-determination. And the "FS" movement is misused in this way to create an ideological fake justification for not capturing value from software. It's important to not participate in the perpetuation of such harmful lies and misuses of principles.

While the ideologies of free software are commendable, they must not be used to repress the freedom of creators to earn from their creations, as is attempted to be done with the line of argument espoused in your comment.

It can be difficult to see people earning from their creations, and it's understandable to have fear that you will not be able to afford software if this idea of charging for it spreads. However, it's important to understand that the current situation is abusive and must be terminated. Exploitation is not sustainable, and the software economy must respect the rights of all participants in order to be just.

I challenge folks to advocate for a more positive and inclusive stance on this issue, that supports creators and clear thinking about the issues involved! :) Dispelling muddy thinking must be a top priority of anyone who aligns with that, and to that end, I encourage you all to re-evaluate your injection of "FS" points into these moments. :)

Re: The Windows installer of ImageMagick will no longer be signed

#357

Earlier quoted context omitted.

No, I am not tangled in it, I'm aware of it. I think you may be tangled in "free software" orthodoxy tho, and confused by it! :) Moreover, I am reflecting the confusion between free as in price-free and free as in restriction-free in the original comment. Ergo: "FS is about freedom" suggests restriction-free. "Not paying rent" suggests price-free. I am also suggesting the FS dogma is deceptive, and clouds the issue.…

FS dogma says you should charge as much as you want, in order to recoup the costs of developing free software. That Microsoft wants to turn freeholder software developers into sharecroppers doesn't affect what "free software" means.

Interesting, where does it say that?

Also how does paying "rent for a spot in the marketplace" turn a freeholder into a sharecropper?

Re: The Windows installer of ImageMagick will no longer be signed

#358

I feel their pain. I built an open source video player for esports coaches[1] that it given away for free and one the constant complaints about it is that users have to bypass warnings when installing it for the first time. I can afford to pay for certificates (I believe I have to have one for Windows and OSX) but I refuse to for a project that I already give away my time for. I would love to see a LetsEncrypt style…

[deleted]

Re: The Windows installer of ImageMagick will no longer be signed

#359

Earlier quoted context omitted.

Yeah and now that person who you paid to register it in your name rats you out to the police. Also, there are a lot of laws you can end up breaking with severe penalties in the course of trying to hide your identity for company registration purposes (it enters the world of anti-money laundering). It's harder than it sounds, which is why malware authors prefer to steal keys than set up fake companies. Hence the new ha…

> Yeah and now that person who you paid to register it in your name rats you out to the police. But they don't know who you are, because you're a scammer who is lying to everyone including them. > Also, there are a lot of laws you can end up breaking with severe penalties in the course of trying to hide your identity for company registration purposes (it enters the world of anti-money laundering). So is credit card f…

So you're going to find these people anonymously, now? How? You'll have to ask a lot of people before someone agrees to actually set up a fake company for you, you'll also have to find ways to pay them without losing your anonymity, and they will have to explain at some point to the tax authority where this unexpected income came from and what the company they've set up actually does.

If it was that easy to hide your tracks police would never catch criminals, but they do. Every time you increase the complexity of the scheme the chance for mistakes goes up.

> that type of consumer hardware has been consistently riddled with vulnerabilities

USB signing devices aren't really consumer hardware, are they? I don't recall vulns in HSMs being a major source of leaks previously, but I'm sure the game will move there sooner or later.

> Intel essentially gave up on SGX because they couldn't make it work

Intel are selling SGX today, have built new features on top of it, it works fine and all their competitors have been investing heavily into catching up.

Re: The Windows installer of ImageMagick will no longer be signed

#360

Earlier quoted context omitted.

I don’t understand what you’re trying to say here, but I’m glad you could at least have a laugh.

Really? It means the way you defined it, there are only two possibilities, and both make you right. So it's a "gotcha", and it's false. Sorry for the typo! If that tripped you up I get it :)

I'm not really sure what your point is anymore. Earlier you wrote this:

> There's a better way to see this: once can make a statement about the principle of the necessity of having transactions to exchange value, but not have a particular demand for the offered good or service themselves. I think that's what's going on here...

You may think that's what's going on here, but I believe it's the opposite. Everyone involved has concluded that there is not enough value to the process of signing the installer. Those that concluded this are probably quite similar to you and me (except maybe that they know _more_ about the work and payoff involved) so if you ask yourself why _you_ wouldn't do it, you probably will know why others choose not to as well.

Anyone who thinks this really is important is free to devote time and money to making it happen. Pointing out that it's worthy of doing to people involved in the project who have decided it's not worth doing isn't that helpful really. Better is to do some self-reflection and ask yourself why you might be wrong in your belief that it is a worthy endeavor considering those in the know have concluded the opposite.

Regardless, I don't really see how it's a gotcha question or whatever.

Post reply on HN