Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Windows installer of ImageMagick will no longer be signed

github.com

Post reply on HN
Print view View original

311–320 of 364 posts

Re: The Windows installer of ImageMagick will no longer be signed

#311

Post by eesmith »

keepamovin wrote: post #249
midasuni wrote: post #172

Earlier quoted context omitted.

Free Software is about freedom. Not paying rent to Microsoft or their partners.

"Freedom for whom?" For the developers whose time they invested. For the users who are not "free" of their problems that prompt them to see these "free" solutions? Nothing about OSS is free. "Free" is a lie. Pernicious, in that it was passed off under the guise of some ideal, yet it undermines the long term sustainability of the field by supporting a sense of entitlement.

You are getting tangled up by the two different meaning of the word "free".

Quoting https://www.gnu.org/philosophy/free-sw.en.html

> “Free software” means software that respects users' freedom and community. Roughly, it means that the users have the freedom to run, copy, distribute, study, change and improve the software. Thus, “free software” is a matter of liberty, not price. To understand the concept, you should think of “free” as in “free speech,” not as in “free beer.” We sometimes call it “libre software,” borrowing the French or Spanish word for “free” as in freedom, to show we do not mean the software is gratis.

The four essential freedoms are:

* The freedom to run the program as you wish, for any purpose (freedom 0).

* The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this.

* The freedom to redistribute copies so you can help others (freedom 2).

* The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this.

Re: The Windows installer of ImageMagick will no longer be signed

#312

Post by technion »

mike_hearn wrote: post #232
technion wrote: post #14

Just throwing in that the dollar value isn't the only cost. I've been using an automated release workflow tomanage signing, eg https://github.com/technion/rustypwneddownloader/blob/main/.... This worfklow isn't usable with these new rules, and I'm having a hard time with the assertion that moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an im…

> moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an improvement on security For most projects it is an improvement, for better or worse. First issue: private keys stored in files can be stolen silently, and then the only recourse is revocation. That's the main reason for the HSM requirement: malware authors have been doing this for some time…

I highly recommend signing dev builds with your proper key because building a reputation of signing legitimate binaries is a strong signal for Microsoft smartscreen.

Re: The Windows installer of ImageMagick will no longer be signed

#313

Post by sime2009 »

kenjackson wrote: post #236
sime2009 wrote: post #132

Earlier quoted context omitted.

Who actually receives the money is not relevant to my core point.

If it’s not relevant to your point, can you make your point without stating something that is false?

"Look at it this way, why should a project like IM pay anyone for the privilege of enriching and adding value to the Windows platform?"

Re: The Windows installer of ImageMagick will no longer be signed

#314

Post by sime2009 »

rat9988 wrote: post #260
sime2009 wrote: post #132

Earlier quoted context omitted.

Who actually receives the money is not relevant to my core point.

Because Ms hasn't asked for it.

Of course MS asked for it. They created and sustain this situation where software needs to signed for it to easily run on the Windows platform. Who do you think put the signature checking code and root keys in Windows?? The code signing gnomes?? fairies??

Re: The Windows installer of ImageMagick will no longer be signed

#315

Post by WorldMaker »

TeMPOraL wrote: post #154
orra wrote: post #116

Earlier quoted context omitted.

Winget just runs installers and uninstallers. I don't think it wrangles dependencies. That is, it won't install a dependency as its own package, nor will it uninstall a dependency when the last dependent is uninstalled.

Honestly, winget at this point is (or is about to be) suffering from the same trust issues GP described. I recently tried to provision a new Windows install with some software, and for many common tools, I found that winget offered suspiciously many similarly named options to choose from. Sometimes all the options look off in some way, like having weird vendor names. For me, this is a regression compared to just down…

winget supports multiple sources and you can filter on them. One of the default sources is 'msstore' and includes the Microsoft Store and it shows all that junk unscrupulous vendors have added. (Keep in mind it is all reportable if it is pretending to be an open source tool but not from an "owner" developer. `winget show package-id` used to include the Store reporting URL but doesn't currently seem to show it. Maybe it was abused?) The other source is 'winget' which is mostly powered by an open source repo [1] that you can file issues against and even try to make PRs.

So far the "winget" source seems relatively well curated. `winget show Package.Id` seems to me reliable at matching up official sites/GitHub releases for that source.

At times I'm tempted to `winget source remove msstore` because it is full of so much junk, but I still also appreciate being able to manage store installs with winget.

[1] https://github.com/microsoft/winget-pkgs

Re: The Windows installer of ImageMagick will no longer be signed

#316

Post by pdntspa »

kalleboo wrote: post #214
pdntspa wrote: post #186

Earlier quoted context omitted.

So, a music player that keeps a database on 25000+ files needs to hold and manage 25000+ capability tokens? Do I have to select all those files in an "Open" dialog box? Hell naw, dawg.

Typically all your music would be in a "Music" folder and not randomly scattered around your file system, it could simply hold a capability for the Music folder.

There are a lot of scenarios where I might want to take the scattered approach, without wanting to authorize the whole parent path. "Show me any mp3 file anywhere in c:\" for example

Re: The Windows installer of ImageMagick will no longer be signed

#317

Post by mikewarot »

pdntspa wrote: post #316
kalleboo wrote: post #214

Earlier quoted context omitted.

Typically all your music would be in a "Music" folder and not randomly scattered around your file system, it could simply hold a capability for the Music folder.

There are a lot of scenarios where I might want to take the scattered approach, without wanting to authorize the whole parent path. "Show me any mp3 file anywhere in c:\" for example

Sure, and the application gets access to all the MP3 files anywhere, if that's what the user tells the OS to let it have. There's no reason that shouldn't be a thing. It's not like we're going to run out at 64k of RAM or something. ;-)

You can hand someone your wallet if you want, or just give them exact change to make it $3.50 We should be able to do simple things like that with our OS.

Re: The Windows installer of ImageMagick will no longer be signed

#318

Post by nolongerthere »

brnt wrote: post #305
nolongerthere wrote: post #280

Earlier quoted context omitted.

Most OS software is downloaded from code repositories like github or fosshub to save on networking costs, not to mention CDNs that are often used even when the link is on the software's website the file itself will often not be "coming from" that website.

> Most OS software is downloaded from code repositories like github or fosshub to save on networking costs, [X] Doubt Do not underestimate the sheer number of people jamming in software names or descriptions into Google and getting their wares on the likes of softpedia.

same difference though, that's the equivalent of a CDN or fosshub. Its definitely not the author of the software.

Re: The Windows installer of ImageMagick will no longer be signed

#319

Post by hermitcrab »

electroly wrote: post #38
technion wrote: post #14

Just throwing in that the dollar value isn't the only cost. I've been using an automated release workflow tomanage signing, eg https://github.com/technion/rustypwneddownloader/blob/main/.... This worfklow isn't usable with these new rules, and I'm having a hard time with the assertion that moving builds to my desktop to use a hardware signing key and uploading them in a non automated, non transparent fashion is an im…

I'm in exactly the same boat; doing the same thing to store my OV .pfx certificate in a GitHub Actions secret. My certificate expires in November 2024 and I'm undecided what I'll do. It was hard enough to get a certificate as a solo developer and not a corporation. Still, though, it should just be a matter of money. The $629/year cloud-hosted HSM mentioned in the OP will do it. If you pay that, you can use this proce…

$629 per year for doing some basic ID checks and basically multiplying 2 prime numbers together. What a scam.

Re: The Windows installer of ImageMagick will no longer be signed

#320

Post by midasuni »

keepamovin wrote: post #249
midasuni wrote: post #172

Earlier quoted context omitted.

Free Software is about freedom. Not paying rent to Microsoft or their partners.

"Freedom for whom?" For the developers whose time they invested. For the users who are not "free" of their problems that prompt them to see these "free" solutions? Nothing about OSS is free. "Free" is a lie. Pernicious, in that it was passed off under the guise of some ideal, yet it undermines the long term sustainability of the field by supporting a sense of entitlement.

Free means you are not imposing restrictions on me, and I am not imposing restrictions on you.
Post reply on HN