3 ms·

This hits me solidly in the feels. Code signing certificates are a great idea if you're a company who gets to charge me hundreds of dollars per year to say tha

This hits me solidly in the feels. Code signing certificates are a great idea if you're a company who gets to charge me hundreds of dollars per year to say that I am who I say I am. Code signing doesn't seem so great from my perspective, because I don't want to have to pay hundreds of dollars per year to a cartel engaging in a protection racket. Unsigned code warnings are nothing more than them saying, "Gosh, it sure would be a shame if we scared away potential users (wink wink)." If the certificates were based on inspection of the actual source code and building the installer inside a trusted environment, that would be one thing, but that isn't how they get assigned. Certificates are assigned based on whether or not I want to give the trust cartel a lot of money. Fuck that.

wolfgke 8y ago
> Code signing certificates are a great idea if you're a company who gets to charge me hundreds of dollars per year to say that I am who I say I am. Code signing doesn't seem so great from my perspective, because I don't want to have to pay hundreds of dollars per year to a cartel engaging in a protection racket. An interesting solution could be that Windows users could get the ability to add additional root certificates for application sign keys to Windows installations.
- will4274 8y ago
  This already exists.
beefhash 8y ago
What's even more problematic is when you get into the shady stuff. I believe it's clear that there are things that people have to develop anonymously for their own safety. Examples include PC tools to reverse engineer stuff, console save file editors, etc. However, precisely because those areas are so shady, it would help if there was a way to get code signing certificates of a lower pedigree but with pseudonymity. The shadier things get, the more likely there will be knockoffs with malware. The more likely there will be knockoffs with malware, the more likely some inexperienced user will accidentally get the (ill-signed) malware knockoff.
z3t4 8y ago
If you want to sign your code on multiple platforms, it's not just hundreds of dollars per year, it's thousands!

wolfgke 8y ago

> Code signing certificates are a great idea if you're a company who gets to charge me hundreds of dollars per year to say that I am who I say I am. Code signing doesn't seem so great from my perspective, because I don't want to have to pay hundreds of dollars per year to a cartel engaging in a protection racket. An interesting solution could be that Windows users could get the ability to add additional root certificates for application sign keys to Windows installations.

will4274 8y ago
This already exists.

beefhash 8y ago

What's even more problematic is when you get into the shady stuff. I believe it's clear that there are things that people have to develop anonymously for their own safety. Examples include PC tools to reverse engineer stuff, console save file editors, etc. However, precisely because those areas are so shady, it would help if there was a way to get code signing certificates of a lower pedigree but with pseudonymity. The shadier things get, the more likely there will be knockoffs with malware. The more likely there will be knockoffs with malware, the more likely some inexperienced user will accidentally get the (ill-signed) malware knockoff.

z3t4 8y ago

If you want to sign your code on multiple platforms, it's not just hundreds of dollars per year, it's thousands!