Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

221–230 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#221

Post by breakfastduck »

pdntspa wrote: post #186
mikewarot wrote: post #101

Why do we let any random application open its own files and folders at will? The actual selection and opening of files and other resources should be the job of the operating system. GUI programs should be able to call "open" "save" and other dialogs to get handles to files, not just their names. The OS should limit access to resources to those it provides (as capability tokens) and nothing else. For CLI programs, the…

So, a music player that keeps a database on 25000+ files needs to hold and manage 25000+ capability tokens? Do I have to select all those files in an "Open" dialog box? Hell naw, dawg.

No, it doesn't work like that. For example, if you had a 'Music' folder that everything was within, you grant access to the Music folder (and thereby any child folders or files).

It's about granting access to a folder and its children, rather than individual access to files.

For example, when you try to import your files, if they are located within the 'Music' folder, the OS will ask if you are OK with the app having read / write access to that folder. You click OK - it will never ask again for anything you store import or interact with under that parent.

Similar to how IDE's ask if folders should be trusted when you open / run projects.

Re: The Windows installer of ImageMagick will no longer be signed

#222

Post by breakfastduck »

alkonaut wrote: post #144
vkazanov wrote: post #118

Earlier quoted context omitted.

Aren't that many pure windevs left these days... In many professional circles Windows itself is no more than a vintage curiosity. So in many ways, WSL is a survival strategy - it makes it possible to stay a relevant developer while working in windows. BTW, I know a case where WSL is nothing short of brilliant: online game development. A lot of times, the backend is running linux only, while the client is windows only…

I think that’s perhaps a selection bias. Tons of people work on windows desktop apps, Microsoft stacks (sharepoint/office/power..) but what they do isn’t on GitHub, it doesn’t end up on Twitter or HN. Perhaps not even on the StackOverflow dev survey. We just go to work and write software. I also think that it’s a matter of where you are at. If you ask anyone in Silicon Valley what tech they use, few will say Windows,…

There are still plenty of 'older' or more specialised software that targets windows desktop, but the vast majority of 'windows' developers are now working within .NET core and targeting web technologies as the 'front end' of choice.

So you could argue either way, but there is a clear noticeable shift away from Windows desktop apps across a lot of industries.

Re: The Windows installer of ImageMagick will no longer be signed

#223

Post by breakfastduck »

geraldcombs wrote: post #138
nolist_policy wrote: post #120

Yet another reason to go with web apps/electron. The electron binary is already signed. And Web apps are good with a Letsencrypt cert.

How are Electron apps typically shipped? If the answer is "inside an installer" then the installer needs to be signed.

Depends on the target platform. For macOS for example it's just the '.app' bundle.

Re: The Windows installer of ImageMagick will no longer be signed

#224

Post by kaetemi »

Reason077 wrote: post #175

> ”Digicert seems to be our only option now but a certificate there would cost $629 (tax excluded) for a single year.” Yikes! At least Mac (and iOS) developers get this for $99/year. What makes code signing so expensive on Windows?

A basic code signing cert can be had at $150 per year. That's already with the thing where they check if your company information is real, and it does the job for SmartScreen. Not sure if there's any advantage in the more expensive ones.

Re: The Windows installer of ImageMagick will no longer be signed

#225

Post by tremon »

1letterunixname wrote: post #79
r4indeer wrote: post #63

Earlier quoted context omitted.

What does this have to do with ImageMagick? They don't control the versions packaged by Canonical [0]. The bug you referenced is fixed in upstream, which you can access for free on GitHub. Ubuntu users on 22.04 LTS or later are also unaffected, because the release came with a version that was already patched [1]. If you upgrade to a newer Ubuntu release, there is no need to pay for ESM. Your comment makes it sound li…

You appear to be leaping to the wrong conclusion. The problem is Canonical charging money for security updates. CentOS, Alma, Rocky, Fedora, Debian, openSUSE, Arch, and 300+ other Linux distros don't charge money for security updates either. The moral of the story is "Don't use enshitifying corporate Linux distros run by crazy people."

The problem of Canonical charging money for security updates is off-topic when we're discussing ImageMagick's code-signing troubles on Windows.

Re: The Windows installer of ImageMagick will no longer be signed

#226

Post by AniseAbyss »

maccard wrote: post #179
TeMPOraL wrote: post #140

Earlier quoted context omitted.

> can’t even scrape together $629 for something as essential as a software signature I don't think the $629 itself is the problem, but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Is it about security, or is it about crying "security" to push through a pay-to-play market?

> but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Putting the price aside just for a second, are there really people out there who think that code signing isn't worthwhile? Remember paint.net/filezilla having ad links to "Download Now" that would download... not paint.net or filezilla?

[dead]

Re: The Windows installer of ImageMagick will no longer be signed

#227

Post by [deleted] »

solarkraft wrote: post #206
maccard wrote: post #179

Earlier quoted context omitted.

> but rather that they're being forced to spend it on something that many people don't agree is "essential" in any way. Putting the price aside just for a second, are there really people out there who think that code signing isn't worthwhile? Remember paint.net/filezilla having ad links to "Download Now" that would download... not paint.net or filezilla?

Yeah, me. It ensures that the binary you have is really from who it claims to be from, which can also be ensured by acquiring it through a secure channel (e.g. an HTTPS-enabled website or package repository). It doesn't give you any guarantees about the binary being free of malware - only that it's really published by the entity you got it from. Granted: Now an actor who wants to inject malware has to hijack the buil…

[deleted]

Re: The Windows installer of ImageMagick will no longer be signed

#228

Post by mike_hearn »

notpushkin wrote: post #192
mike_hearn wrote: post #159

Earlier quoted context omitted.

Because domain names are cheap and can be purchased in bulk. TLS certificates are for encryption. You don't care if the endpoint is "bad" in some way, only that you are communicating with it securely. Code signing certificates are to make bans stick. Totally different purpose.

Companies aren't cheap, but they aren't exactly expensive either. A couple weeks ago I've registered a company in Estonia – it only cost me the 265 € state fee. Code signing certificate is another what, 500 euro on top of that? Certainly more expensive than a $10 domain with a free certificate, but still could be a reasonable cost for e. g. a targeted attack. There's another catch – you either have to register a comp…

Yeah and now that person who you paid to register it in your name rats you out to the police. Also, there are a lot of laws you can end up breaking with severe penalties in the course of trying to hide your identity for company registration purposes (it enters the world of anti-money laundering).

It's harder than it sounds, which is why malware authors prefer to steal keys than set up fake companies. Hence the new hardware requirements.

Re: The Windows installer of ImageMagick will no longer be signed

#229

Post by mike_hearn »

maccard wrote: post #177
mike_hearn wrote: post #157

Earlier quoted context omitted.

Windows has already made that journey years ago. The MSIX system works the way you suggest: • Admin privs aren't needed • Packages declare what integration points they need in an XML file It's similar to the way macOS, iOS and Android work. You can also (starting soon in Win11) declare that the app will be sandboxed. However, developers have to actually use this system and most don't know it exists or how to use it.…

> The ImageMagick developers can fix their problem by purchasing a cheap OV code signing certificate and then using Conveyor By "cheap" you mean $500/year[0]? Then for anyone who isn't open source it's another $45/month on top for Conveyor. That's hardly "accessible". That said, Conveyor looks awesome. We (thankfully) distribute our application via Steam/EGS/etc but when we were looking at bundling installers before…

Well, firstly, buying certs is optional. You can distribute via the Microsoft Store and they'll sign for you. That's a $19 one time fee, no subscription. It's by far the cheapest way to distribute signed software on Windows. Conveyor can prepare everything and do the upload for you.

So this stuff only applies if you don't want to go via the store.

Now you picked DigiCert and their cloud HSM solution. They're unfortunately quite expensive. SSL.com is a lot cheaper:

https://www.ssl.com/certificates/code-signing/buy/

So about $100 / yr, with a one off fee to buy a USB key.

And then ImageMagick is open source so they could use the tool for free.

Even commercially, $100/yr plus $45/month isn't particularly expensive compared to the labor cost of developing software commercially. The cost of the tool is like one hour of skilled labor at contracting rates per month. It'll save far more time than that given that as you said, doing deployment by hand is a nightmare.

And as you note, if your app is open source then you can use it for free. So then we're down to using the MS Store + Conveyor for free: $19, one off. Anyone can afford that.

Re: The Windows installer of ImageMagick will no longer be signed

#230

Post by 0x000xca0xfe »

keepamovin wrote: post #142
pentagrama wrote: post #139

Earlier quoted context omitted.

$629/year

Sure. Yep that’s what i meant. 629/yr. It’s travesty they can’t afford it. Can’t edit now. Thank you for clarifying!

They surely can afford it, they just rather spend it on more meaningful things.

Like taking out your entire family for dinner, having a developer meetup or whatever they do with their own money.

You seem to be both interested in ImageMagick and having certified binaries, why don't YOU pay it?

Post reply on HN