Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

291–300 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#291

Post by marcosdumay »

Y_Y wrote: post #220
bmicraft wrote: post #209

Earlier quoted context omitted.

White is quite a flexible term. The suns (color) temperature is 5778K.

That's a weirdly precise measurement of the temperature of sunlight. Colour temperature isn't really a precise way of measuring colour since not even a body like the sun really acts as a black body emitter. All that said, colour temperatures around six thousand kelvins are certainly describable as white and not as yellow.

The Sun is an almost perfect black body emitter. Outside of our atmosphere, it's perfectly so, and the atmospheric distortion is imperceptible.

Any reasonable representation of its color would classify the Sun as white, except when comparing it to other stars, where the small differences matter a lot.

Re: The Windows installer of ImageMagick will no longer be signed

#292

Post by electroly »

Avamander wrote: post #279
notpushkin wrote: post #194

Earlier quoted context omitted.

Binaries are timestamped though. If you sign it, it's practically valid forever (unless you revoke the signature).

It takes more than the signing date to assert validity at the time of signing rather than at the time of checking. This means that these signatures tend to expire when the code signing certificate or the CA itself expires.

That's why you get a timestamp countersignature; that's what the person you're replying to is talking about. They are absolutely correct. This is standard practice. Signed executables on Windows DO NOT lose trust when the certificate expires as long as they are cryptographically timestamped.

https://learn.microsoft.com/en-us/windows/win32/seccrypto/ti...

My first code signing certificate from long ago is already expired; the signed executables under that certificate are still trusted by Windows.

Re: The Windows installer of ImageMagick will no longer be signed

#293

Post by tsimionescu »

doophus wrote: post #71
tsimionescu wrote: post #61

Earlier quoted context omitted.

How could it not? It is adding software to the system software set, accessible by all users of the system. And many programs require some kind of integration into the OS, such as file type associations or context menu entries, which even a single user shouldn't have access to do.

Most software installers on Windows offer the user a "Install for this user"/"Install for all users" option, or will just install to the current user's appdata, which doesn't require admin rights.

It's definitely not "most". It does happen, but it's actually very rare. Most people nowadays who go to the trouble of making a native installer do so because they want some kind of OS integration, so it's a nonstarter anyway.

Re: The Windows installer of ImageMagick will no longer be signed

#294

Post by CogitoCogito »

keepamovin wrote: post #283
CogitoCogito wrote: post #265

Earlier quoted context omitted.

Mine wasn’t a “gotcha” question. If the poster’s answer is “no” (i.e. that they don’t want to pay for or run such a system), then maybe they should consider that the same applies to everyone else.

That's the definition of a "gotchat". Yes: problem solved, no issue. No: problem solved, no issue. Ha, gothca! Hahaha :) Thanks for the laugh, pal. I'm outta here fer now! :) ;p xx ;p

I don’t understand what you’re trying to say here, but I’m glad you could at least have a laugh.

Re: The Windows installer of ImageMagick will no longer be signed

#295

Post by tsimionescu »

Too wrote: post #90
tsimionescu wrote: post #61

Earlier quoted context omitted.

How could it not? It is adding software to the system software set, accessible by all users of the system. And many programs require some kind of integration into the OS, such as file type associations or context menu entries, which even a single user shouldn't have access to do.

This way of working should have been left behind in the previous century. Sandboxing should be default. Associating file endings should be a suggestion to the OS, accepted by the user, not something only configurable by delegating full super admin to third party app. Slow loading context menus where every app tries to claim its presence. Thank you for reminding me why I don’t use Windows since years ago. A image edit…

I disagree entirely. The only reason for creating native apps is to allow apps to interoperate and integrate deeply with the OS. Apps should be free to pass data around with each other, and this absurd level of security overreach, suggesting every app should be sandboxed, is actively hurting the computing world.

Sure, if you're making a game or some browser replacement, then go for sandboxing. But most productivity software shouldn't be confined to that. We need computing to stay open, not to all be closed down mobile OS style.

Re: The Windows installer of ImageMagick will no longer be signed

#296

Post by Y_Y »

marcosdumay wrote: post #291
Y_Y wrote: post #220

Earlier quoted context omitted.

That's a weirdly precise measurement of the temperature of sunlight. Colour temperature isn't really a precise way of measuring colour since not even a body like the sun really acts as a black body emitter. All that said, colour temperatures around six thousand kelvins are certainly describable as white and not as yellow.

The Sun is an almost perfect black body emitter. Outside of our atmosphere, it's perfectly so, and the atmospheric distortion is imperceptible. Any reasonable representation of its color would classify the Sun as white, except when comparing it to other stars, where the small differences matter a lot.

Maybe you are more forgiving than I am, but the spectrum of the sun even measured from nearby in space is distinctly different to a Planck spectrum[0].

[0] https://www.e-education.psu.edu/meteo300/node/683

Re: The Windows installer of ImageMagick will no longer be signed

#298

Post by mike_hearn »

Avamander wrote: post #278
mike_hearn wrote: post #258

Earlier quoted context omitted.

Yes CA/B Forum sets policies for Windows code signing certs and CAs just follow, even in cases where it's harmful to their customers or obviously dysfunctional :( CA/B Forum and its members are ignored by Apple and for good reasons. They run their own PKI which is a lot easier to use and cheaper.

Good reasons, such as? Actually trying to mandate some sort of secure storage is not a "good reason"? Have you not read about how many of those keys have been stolen and abused?

I'm well aware! It's actually Microsoft that originally pushed for that change, CA/B Forum just implemented it IIRC.

Apple's PKI:

1. Has a much easier verification process.

2. Is a lot cheaper, dev program membership is ~$100/yr and they throw in a couple of DTS incidents as well.

3. A big one: Apple's PKI issues certificates with long term stable identifiers (team IDs). CA/B PKI specifies all kinds of random details that CAs have to follow but the subject name isn't one of those, so systems that use the subject name as a key (which Windows does in various places) will immediately forget who you are if you change to a competing CA, or change your company name, or it relocates its HQ, or if you change OVEV, or if they just change their policies again for no real reason. This problem makes CA/B certificates largely useless in practice because you can't associate anything with the verified identity. They know this problem exists because I have raised it with them specifically, and they don't care.

5. The root and intermediates are more stable (experience odd expiration/cross signing issues less or not at all).

6. Apple hardware can protect private keys using the secure element that comes with the device, so it can have equivalent security without needing the USB token. USB tokens have a bunch of issues. Also Apple's OS can limit those hardware protected keys to specific bits of software too, so you can ensure that only your code signing tool or build process can access the key. USB dongles can't do this, anything that can talk USB and get your credential can use it.

So those are some specific technical justifications for you.

Re: The Windows installer of ImageMagick will no longer be signed

#299

Post by mike_hearn »

electroly wrote: post #290
mike_hearn wrote: post #232

Earlier quoted context omitted.

> moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an improvement on security For most projects it is an improvement, for better or worse. First issue: private keys stored in files can be stolen silently, and then the only recourse is revocation. That's the main reason for the HSM requirement: malware authors have been doing this for some time…

"Cloud HSMs" are allowed by the CA/B rules which wholly negate the benefit for that second issue and bring us back into the situation where anyone who checks code into CI can sign with the key. The CA/B rules are really just concerned with the first issue, right?

Yes, the current rules aren't attempting to litigate full supply chain security. If you look at how the cloud signing services work though, the underlying protocols are designed to allow 2FA authenticators. They give you a TOTP seed, it's not just a basic password. They can't prove the seed was put into a real 2FA authenticator app though, so in practice you can use it as if it's a password.

Re: The Windows installer of ImageMagick will no longer be signed

#300

Post by MilStdJunkie »

I'm not a super gee-whiz technical guy, but what exactly are you getting out of a windows installer vs *.exe + ENV variables? I personally prefer software that just runs as packaged executable, and I can add system variables either at launch or by myself. It's always a little sus when a tool doesn't have a portable release.

It's sort of my secret solution to using software I need from gimped userland, although I know it lights alarms in the big InfoSec secret dungeon. Luckily, they're lights for "Visual Studio Code", so that "alarm" is on all the time.

Post reply on HN