Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ drops code signing for its releases

notepad-plus-plus.org

Post reply on HN
Print view View original

211–220 of 335 posts

Re: Notepad++ drops code signing for its releases

#211

Post by Intermernet »

NullPrefix wrote: post #165
juliusmusseau wrote: post #104

Earlier quoted context omitted.

Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public direc…

>Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. I don't trust poor people either. Bigger chance that they're scaming .... because they need the money.

The flip side of this reasoning is that successful scammers aren't poor, but they are very likely to to still be scammers.

Re: Notepad++ drops code signing for its releases

#212

Post by jmull »

vkaku wrote: post #79

Good for them! Certificates are a bad business today. The only reason I'd get one is because things like letsencrypt exist; Orthogonally, I also think that $99 App Store fees are a terrible waste of money. You should get charged only when submitting to an app store for review. There are plenty of root certificates that came installed on my computer, and I don't even trust them. Why would these CAs charge so much for…

I believe Apple has a free tier. There are limitations. It sounds like you'd be fine with some of them, like you can't distribute though the app store. But I think apps you load on your device expire quickly and there are other limitations, so it really is for development, and not a great way to side load apps.

Re: Notepad++ drops code signing for its releases

#213

Post by fbelzile »

ilaksh wrote: post #197
fbelzile wrote: post #144

I'm going through a "renewal" right now... The archaic maze of validation is also getting on my nerves. It's been three weeks now that I'm waiting for a phone call to validate my phone number. This article is making it so tempting to cancel my order. The plethora of support emails is what motivated me to get one in the first place. I used to get accused of giving users a "virus" and getting into infinite loops on why…

Is it k-software/Comodo/Sectigo by any chance?

Yes, Sectigo via The SSL Store.

Re: Notepad++ drops code signing for its releases

#214

Post by ex3ndr »

gruez wrote: post #159
ex3ndr wrote: post #133

Earlier quoted context omitted.

This certificate doesn't help to bypass UAC and "unsecure" prompt still be shown to the user.

That's incorrect. All code authenticode signing certificates (trusted by microsoft) turns the UAC prompt from yellow to blue. EV certificates is probably for auto-trust for smartscreen.

Only after you noticed that UAC color is blue instead of yellow i started to see difference.

No user will understand this though.

Re: Notepad++ drops code signing for its releases

#215

Post by WorldMaker »

criddell wrote: post #19
tomc1985 wrote: post #14

Earlier quoted context omitted.

It's an obscure product with few providers

Is code signing part of what you get from Apple for your $99 developer fee? If so, then that suddenly feels like a bargain.

It's also a part of Microsoft Store development fees (similarly $99 last I checked), if you release through the Store all code signing is handled through the Store.

Re: Notepad++ drops code signing for its releases

#216

Post by Tsubasachan »

Svoka wrote: post #70

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php

At least Windows lets you install pretty much whatever you want. None of this nonsense is mandatory.

Re: Notepad++ drops code signing for its releases

#217

Post by Tsubasachan »

fjabre wrote: post #17

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These…

Problem is that people suck. They don't blame themselves for doing something stupid. They blame Microsoft. Personal responsibility? Ha!

Re: Notepad++ drops code signing for its releases

#218

Post by Nasrudith »

Spivak wrote: post #157
meditate wrote: post #95

Earlier quoted context omitted.

It doesn't make it inherently safe, but if you are attempting to prove your builds are safe then it is impossible for anyone else to verify that without the source. See the thread on Debian reproducible builds from earlier this week for more discussion on this topic: https://news.ycombinator.com/item?id=19310638 Code signing is something you can do on both open-source or closed-source, but it doesn't prove anything o…

"but it doesn't prove anything other than that a particular build was made by a certain person." But that's what trust actually is . This IRL person or identity, that I trust, vouches for the non-maliciousness of this application.

Except the core problem is key propagation because just anyone can have a key - paid or free if you don't know the source. It says it is from Globe Software and it matches with the provided key. It doesn't tell you if they really are Globe Software, let alone if they are a trustworthy company in the first place.

Re: Notepad++ drops code signing for its releases

#219

Post by zanderz »

burtonator wrote: post #146

I created a huge rant on code signing certificates here: https://www.youtube.com/watch?v=mwuk0E-tfeg It's a nightmare. Complete scam. I needed this for Polar: https://getpolarized.io/ Mind you... it's Open Source but I still want my users to be able to download it without warnings. No joke - it took me 2 weeks to get the CSC with about 4 hours per day working on just this CSC issue. It's just a labyrinth of insanity…

There is also the issue that an EV cert has to live on a USB dongle and be "logged into" with some utility before being available for signing. Logging out the current user or even allowing the screen to sleep will lock the cert again. So, for automating signed builds, the only option is to leave the machine logged in and unlocked at all times, clearly obviating much of the "security" gained from all those restrictions.

Re: Notepad++ drops code signing for its releases

#220

Post by criddell »

magnat wrote: post #47
criddell wrote: post #16

Earlier quoted context omitted.

Why bother checking the signature of dependencies if the main executable integrity isn't being checked? What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.

It's not about the price, but about name on the certificate: > However I cannot use "Notepad++" as CN to sign because Notepad++ doesn’t exist as company or organization CAs would put author's name as CN, which isn't great, especially for collaborative project.

That doesn't seem like it should be a deal breaker, especially for something security related.
Post reply on HN