111–120 of 156 posts
They should really name the CA. It's quite common for 1 of the 60 tests on virustotal.com to turn up a false positive.
Even if you sign your exe and build package, you have a 50% chance of being detected as a virus by some "heuristic" AV engine (looking at you, Norton and Kaspersky).
Basically, the heuristic is anything new = suspicious.
Earlier quoted context omitted.
People are not recommending 7-zip in response to the cert problem but rather to someone directly asking for a superior alternative in https://news.ycombinator.com/item?id=24284253 Regardless, 7zip does not have as much of a need for a certificate because it is foss so you do not need to trust the creators, in comparison to winrar which isn't and you need to trust them.
The fact that it is FOSS makes it _easier_ for someone to compile it with a backdoor or trojan. I would say the need for a certificate is _higher_ there. You don’t need to trust the developers, you need to be able to trust the people who have built the executable.
It is particularly ironic that so many people in this thread are recommending 7-zip in response to a cert problem with WinRAR when 7-zip has no code signing at all and presents the scary yellow "unknown software" screen when you try to install it.
I didn't even realize that the "scary" yellow prompt was related to code signing. For me it was just what happens when you run an executable from the internet. Do anyone pays attention to this? There is a lot of legitimate software you can't install without clicking through. 7-zip is just one of them.
https://www.digicert.com/blog/ms-smartscreen-application-rep....
> We think that revoking certificates based on questionable data discredits the certification system. It's hard to dispute this imo. There are many good reasons certificates should be revoked, but the reasoning should be 100% public information, for both the vendor and users who may have trusted the original certificate. I'm building a desktop app, and the process to even get a certificate is absurd. Each CA has thei…
Let's Encrypt's argument for why all the fancy features that CA's offered boiled down to "These are more complicated ways of proving that you own a domain". So by automating the verification of ownership of a domain you could essentially run a CA for pennies per certificate, and give them out for free. Looking at application development I think a similar thing could be done, but what would we pin identity to? I don't…
in order to have your code signed right now, you have to purchase a signing certificate. so we're already enforcing a "you have to buy this thing to have your code signed" rule. there's no reason that thing you have to purchase couldn't be a domain name instead - it's no more onerous than making the developer purchase a cert, but 99% would already have one.
Earlier quoted context omitted.
I haven’t used WinRAR in ages, but what makes 7zip (which I use as well) better?
7zip is completely free and OpenSource, and more modern. I think that they also support more archive formats and they even have their own open format 7z. Based on their own claims, there are also faster and more efficient than Winrar.
With both Windows and MacOS both putting scary warnings and hard to bypass blocking methods on improperly signed software this could eventually lead to developers being ransomed, “pay us big money or we will revoke your certificate”. This is not the only incident like this.
A non-problem. Linux will run on x86 hardware till the end of time.
Earlier quoted context omitted.
...previously known as Comodo. Did their reputation was so bad that they had to rebrand? https://sectigo.com/resource-library/comodo-ca-is-now-sectig...
Yes they've been pretty much terrible. https://www.techdirt.com/articles/20160623/17483934805/super...
> We think that revoking certificates based on questionable data discredits the certification system. It's hard to dispute this imo. There are many good reasons certificates should be revoked, but the reasoning should be 100% public information, for both the vendor and users who may have trusted the original certificate. I'm building a desktop app, and the process to even get a certificate is absurd. Each CA has thei…
I agree that it would be nice to have a letsencrypt for code. The biggest hurdle I see is getting the the root trusted by OS vendors. While not impossible (the browser vendors did it), trust on these platforms may be a bigger issue since the code runs natively.
To install the certs manually takes a bit of research. I recently wrote a Node.js script to do this in my application cross-OS using a Stackoverflow answer as a reference.
Earlier quoted context omitted.
Professional developers have to write code that runs on their customers' systems.
The customers have a VM for this that will be likely delivered indefinitely for this purpose: Webkit + friends.
Earlier quoted context omitted.
The other consideration is that verifying identity is pointless , because malware authors don't actually use their own identities, they just pull a code signing certificate from the 1% of their already-infected users who have one. Then they go out and infect a million more users with it and get 10,000 more code signing certificates. If all you're after is some kind of rate limiting then forget about identity verifica…
That doesn't rate limit wealthy attackers, it just locks regular individuals out of the system. Peter Thiel could still buy 10,000 malicious certificates at $500/ea, while I wouldn't even be able to buy one for a simple project.
That said, the latter part does make this a non-starter, although the same is true of most means of identity verification, which lock out anyone with inadequate identity paperwork.