3 ms·

How? For the average user (which are who companies really care about), code signing offers an important level of protection. Sure this would be an improvement f

How? For the average user (which are who companies really care about), code signing offers an important level of protection. Sure this would be an improvement for technical users who want something hackable, but that's a small fraction of the market.

marssaxman 11y ago
Code signing is a fix for problems introduced by automatic firmware updates. Intead of going further down the chain by trying to fix the problems with code signing, I'd rather take a step back and find a better fix for the original problem. Besides, I don't believe that firmware updates need to happen so frequently that there needs to be a convenient way to install them. It's okay if they are a nuisance, because a majority of devices will be updated zero times in their usable lifetimes, and a majority of the rest will be updated one time.
- michaelmior 11y ago
  It's not about convenience, it's about security. Regardless of how many menus you have to go through or buttons you have to press if your device will just execute any code that it gets with no way to authenticate the code, you're asking for trouble. At the very least, the device should use a secured connection to download updates from the manufacturer.
  - marssaxman 11y ago
    How about the device does nothing, and I can download updates from the manufacturer if I choose to? It's my device, not theirs, and I will decide when and if I want to update it.
    - michaelmior 11y ago
      Sure. If that's what you're looking for in a device. Some users prefer their devices to update on their own. Take Google OnHub[0] for example. They make it pretty clear that new updates will provide significantly enhanced functionality. For users who want a device like that, securing updates is still important. [0] https://on.google.com/hub/ https://on.google.com/hub/

3 ms·

How? For the average user (which are who companies really care about), code signing offers an important level of protection. Sure this would be an improvement f

by michaelmior 11y ago

marssaxman 11y ago
Code signing is a fix for problems introduced by automatic firmware updates. Intead of going further down the chain by trying to fix the problems with code signing, I'd rather take a step back and find a better fix for the original problem. Besides, I don't believe that firmware updates need to happen so frequently that there needs to be a convenient way to install them. It's okay if they are a nuisance, because a majority of devices will be updated zero times in their usable lifetimes, and a majority of the rest will be updated one time.
- michaelmior 11y ago
  It's not about convenience, it's about security. Regardless of how many menus you have to go through or buttons you have to press if your device will just execute any code that it gets with no way to authenticate the code, you're asking for trouble. At the very least, the device should use a secured connection to download updates from the manufacturer.
  - marssaxman 11y ago
    How about the device does nothing, and I can download updates from the manufacturer if I choose to? It's my device, not theirs, and I will decide when and if I want to update it.
    - michaelmior 11y ago
      Sure. If that's what you're looking for in a device. Some users prefer their devices to update on their own. Take Google OnHub[0] for example. They make it pretty clear that new updates will provide significantly enhanced functionality. For users who want a device like that, securing updates is still important. [0] https://on.google.com/hub/ https://on.google.com/hub/