Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft terminated the account VeraCrypt used to sign Windows drivers

sourceforge.net

Post reply on HN
Print view View original

481–490 of 526 posts

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#481

Post by rogertcb »

zx2c4 wrote: post #39

This is the same problem I'm currently facing with WireGuard. No warning at all, no notification. One day I sign in to publish an update, and yikes, account suspended. Currently undergoing some sort of 60 days appeals process, but who knows. That's kind of crazy: what if there were some critical RCE in WireGuard, being exploited in the wild, and I needed to update users immediately? (That's just hypothetical; don't f…

After all these statements from M$ claiming they’ve replaced people with AI, wouldn’t be one bit surprised if this “bureaucratic behaviour”, was in fact, some agentic behaviour.

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#482

Post by account42 »

electroly wrote: post #388
ComputerGuru wrote: post #370

Earlier quoted context omitted.

Thanks for sharing your experience. I have been code signing releases for over a decade as an indie publisher myself, until I found myself effectively iced out by the HSM requirement, the increased cost, and the shortened cert lifetimes, which, as someone with certain executive order dysfunctions, I already had a hard time being on top of with the old (multi-year) lifetimes. I just migrated to MS artifact signing and…

I believe you. I also found that many CAs will not deal with a solo developer; that's real. But Sectigo continues to offer HSMs to solo developers. The link I used is [1], you buy the HSM along with your first certificate and they ship it to you. $300/year for the cert, $90 one-time for the HSM. That's not cheap but I think for specific developers looking for an escape from the store, it's a good price for freedom. T…

> it's a good price for freedom

For a freedom you didn't have to pay for at all? Why accept this absurdity?

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#483

Post by account42 »

politelemon wrote: post #13
jonathanstrange wrote: post #9

Earlier quoted context omitted.

As someone who is just planning to publish signed desktop software for Windows, this is deeply worrying. What reasons could there be for cancelling a certificate, especially when it has been used for years and the identity is already established? Are there some ways to combat such decisions legally?

This is a concern and risk that has realised itself multiple times over the past decades. There have been multiple stories linked to multiple developers in the past. If you publish to any closed platform including ios, mac, win, android, this is the risk you run and a condition of operating you will need to accept.

For open source user space programs, another option is to just not sign your software. Will annoy your users, some of which will annoy you in turn, but many are already trained to ignore the scary warnings Windows shows in that case and more will continue to be trained until more reasonable options exist.

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#484

Post by account42 »

DHowett wrote: post #214
nslsm wrote: post #84

Earlier quoted context omitted.

You also get a huge watermark that says "Test Mode" that takes up the entire screen (not kidding)

Three lines of text in 12-point font in the corner which can be covered by a window is hardly “the entire screen.”

That's the same argument which ends win 90% of screen real estate covered in ads.

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#485

Post by account42 »

iamniels wrote: post #23
nixpulvis wrote: post #12

We need a better way to sign and verify software. Clearly companies like Microsoft and Apple have not been good for the open source communities and are inhibiting innovation.

We need better OSes such that signing of software is not required to keep your computer safe.

We need to stop trying to solve computer security entirely through technical means. We don't do that for any other kind of crime.

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#486

Post by account42 »

PunchyHamster wrote: post #14
nixpulvis wrote: post #12

We need a better way to sign and verify software. Clearly companies like Microsoft and Apple have not been good for the open source communities and are inhibiting innovation.

Just add code cert generation to letsencrypt, it's not like MS validates the code that you sign used certs from them anyway

The same let's encrypt that recently removed support for using their certificates in clients because Google told them to?

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#487

Post by account42 »

kbolino wrote: post #442
PunchyHamster wrote: post #14

Earlier quoted context omitted.

Just add code cert generation to letsencrypt, it's not like MS validates the code that you sign used certs from them anyway

Actually, Windows by default will not trust code signed by CAs that issue certificates to websites. It will only trust code signed by CAs that are approved for code-signing, which isn't a very large set anymore. Moreover, recent CA/Browser Forum policies forbid dual-use CAs anyway. If Let's Encrypt issues you a certificate for a web site, it cannot be used for code signing. It's possible that they could start issuing…

> However, domain validation is almost completely irrelevant to, and insufficient for, code signing.

It's actually the only thing that provides any kind of assurance to users. It's not like end users know if FuzzCo is the correct developer for FooApp but they know fooapp.com.

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#488

Post by account42 »

sunshine-o wrote: post #315
SeanDav wrote: post #48

Earlier quoted context omitted.

Except compulsory age verification in Linux is now becoming a real threat. Some Linux distros are actively against this but many are not seemingly interested in fighting it: CachyOS, Ubuntu, Fedora and others. Age Verification is the thin end of a much bigger wedge in "open" OS's

Yes time to wake up. I really believe most "open source" big projects have been compromised long ago. We have saw all those "Foundations" taking them over with all their governance, bureaucracy and goal which do not make any sense at the first look. One example is Fedora, which is part of "The Digital Public Goods Alliance" [0], "a multi-stakeholder initiative that accelerates the attainment of the Sustainable Develo…

Yes, all the code of conducts pushed onto open source projects, often by outside actors or novice contributors backed by a mob, has been mostly about replacing people who care about the projects with people who care more about following rules and will do what they will be told.

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#489

Post by account42 »

akimbostrawman wrote: post #62
SeanDav wrote: post #48

Earlier quoted context omitted.

Except compulsory age verification in Linux is now becoming a real threat. Some Linux distros are actively against this but many are not seemingly interested in fighting it: CachyOS, Ubuntu, Fedora and others. Age Verification is the thin end of a much bigger wedge in "open" OS's

the current law requires no verification at all simple attestation, you could put in _any_ age. it also does not effect linux distros as a whole, only distros in jurisdictions with the laws.

That's how these things always go. No one is ever asked to build the whole thing, just provide one more brick.

Re: Microsoft terminated the account VeraCrypt used to sign Windows drivers

#490

Post by account42 »

pocksuppet wrote: post #235
SeanDav wrote: post #67

Earlier quoted context omitted.

Sure, for now... I simply don't believe it will stop at "simple attestation", because we all know that simple attestation is practically useless, but once the various distros accept this "trivial" inconvenience, "Age verification 2" with harsher requirements will soon be on the way. I would be ecstatic to be proved wrong on this, but experience tells me that is not likely to happen.

Simple attestation is very useful for the case where a parent gives a child access to a computer and wants that computer to block porn. That's the use case everyone is clamoring for, and asking the root user "how old is this user?" solves it in a simple, open, privacy-preserving way. Everybody wins, except the teenager who wants to watch porn. If this were not legally mandated, everyone would support it as a useful f…

If you think you are anyone can stop motivated teenagers from watching porn then I have a bridge to sell you. That is such an absurd goal that you really should be asking what the real motivations for this are.
Post reply on HN