41 ms·

Notepad++ drops code signing for its releases

496 points by pmh 8y ago

gruez 8y ago
Why not use something like certum[1]? It's $69/year (cheaper if you already have a smartcard), but the CN ends up with something like "Open source developer, [full name]". It's not "notepad++" like the author wants, but it's still better than nothing. [1] https://en.sklep.certum.pl/data-safety/code-signing-certificates/open-source-code-signing-984.html https://en.sklep.certum.pl/data-safety/code-signing-certific... edit: updated price
- velcrovan 8y ago
  To attempt an answer of your question "why not", I would say perhaps it's not worth $70 a month for the UAC popup to be blue instead of orange
- gpm 8y ago
  "It's $828 per year" for ... a cert? What makes code signing this expensive?
  - tomc1985 8y ago
    It's an obscure product with few providers
    - criddell 8y ago
      Is code signing part of what you get from Apple for your $99 developer fee? If so, then that suddenly feels like a bargain.
      - morpheuskafka 8y ago
        Yes, that fee includes the ability to sign iOS apps for local distribution and submit them to the App Store, where apple will sign them. On macOS, it also allows code signing for general distribution like Windows has, as well as App Store submissions. I think the issue most people have with the price is that on iOS there's way more limits on running locally without a cert (7 days max), but for someone who is a practicing developer it's really a pretty low cost. If only it came with a mac to develop on...
        baroffoos 8y ago
        >but for someone who is a practicing developer it's really a pretty low cost. Hah! I don't know about you but when I first started app development I didn't even have a credit card, let alone $99 on it to spend. Thankfully I could install my apps on android for free.
      - WorldMaker 8y ago
        It's also a part of Microsoft Store development fees (similarly $99 last I checked), if you release through the Store all code signing is handled through the Store.
  - eps 8y ago
    Greed, mostly. Digicert lists EV code signing certs as $664/yr. But if you are to enter their site through a side door or just plainly cry into the support's jacket, then the price magically drops to $104/yr. And that's for an EV cert! So the only reason there are $600 certs is that there are people who do pay that.
    - jlongster 8y ago
      Yeah, I about an EV cert from digicert for ~$100/year. People pay >$600/year?? What? I never even saw those prices! Not sure how I landed on digicert but I think it was a Microsoft article listing where to get EV certs.
    - docode 8y ago
      And where is this sidedoor?
  - pishpash 8y ago
    It's businesses' customers who find more than $828/yr of value collectively in seeing a certain icon.
- garaetjjte 8y ago
  It's 25€ yearly. (store page states that it requires Certum smartcard, but any card supported by Windows works, including windows virtual smartcards)
  - gruez 8y ago
    thanks, fixed.
- MikusR 8y ago
  If you are wiling to sponsor it, contact the author.
- deleted 8y ago
  [deleted]
- jacekm 8y ago
  They've already tried it https://twitter.com/Notepad_plus/status/1098519332852822016 https://twitter.com/Notepad_plus/status/1098519332852822016
  - gruez 8y ago
    If you read further down (https://twitter.com/Notepad_plus/status/1098553736656572416 https://twitter.com/Notepad_plus/status/1098553736656572416), you find out it's because certum didn't allow them to use "notepad++" as the CN (probably because it's not a valid legal entity).
- pornel 8y ago
  It's nice they support FOSS, but both the CA process and Microsoft's tooling for this are stuck in the year 1999: • The registration process is painfully manual (including e-mailing scanned documents). It's like an "Enterprise" CA from before Let's Encrypt. • The website wouldn't send the final cert to any browser other than Internet Explorer. • Microsoft's signing tools are a hot garbage. All options default to "subtly wrong". To get a working signature you need a half dozen flags in an exact order, different from what the official documentation uses. • Microsoft's docs are either: a) plentiful but only tangentially related vague introduction, or b) scraps of incomplete technical information, mainly for Windows XP only. It's as if they've tried to improve it many times, but every time gave up after rewriting the first chapter. • Signing can't be automated or used remotely, because its weirdo software wants a PIN entered from the local keyboard.
asveikau 8y ago
Interesting that they will check the hashes of dependencies at runtime. But then I start to wonder - why dynamic linking if the library can't be replaced?
- criddell 8y ago
  Why bother checking the signature of dependencies if the main executable integrity isn't being checked? What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.
  - asveikau 8y ago
    I suppose we could all demand a refund. Edit: downvoted? The project is GPL, not a revenue source.
  - mattnewport 8y ago
    Price doesn't seem to be his primary issue.
  - magnat 8y ago
    It's not about the price, but about name on the certificate: > However I cannot use "Notepad++" as CN to sign because Notepad++ doesn’t exist as company or organization CAs would put author's name as CN, which isn't great, especially for collaborative project.
    - techsupporter 8y ago
      Yep and sometimes the name people know isn't the name that a CA will permit in a certificate. I have one of those. I'm known as a shortened version of my middle name, say Jack Quimby, but DigiCert and others insist that the cert be issued to Alphonse Jackson Quimby, Jr. OK I'll just buy an LLC from a state that's cheap (never mind the paperwork) but that's no good either because the new entity had no listed phone number...
jimktrains2 8y ago
> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors. I'm not sure what the author means by this.
- daveFNbuck 8y ago
  The author is saying that signing certificates are something that FOSS authors enjoy using, but they have no practical purpose outside of that enjoyment.
  - SmellyGeekBoy 8y ago
    I don't know, getting rid of the huge "YOU MAY BE INSTALLING DANGEROUS SOFTWARE" warning in Windows 10 seems like a practical purpose.
    - mikewhy 8y ago
      For that you need to shell out even more for an EV Cert. If you just have a regular cert, people are still warned when running your app.
      - Leace 8y ago
        "are still warned" for ~ 2 weeks, then it is trusted: https://news.ycombinator.com/item?id=19330564 https://news.ycombinator.com/item?id=19330564
  - jimktrains2 8y ago
    I guess I haven't used systems with code signing like this. Is it really that common?
- tomc1985 8y ago
  Codesigning certs are a racket... the 'chain of trust' and documentation requirements mean they are expensive and hard to get as an individual, yet oh-so-essential for releasing software. Which also makes them status symbols, which the author is rejecting. I kind of see them like taxi medallions
draw_down 8y ago
Feels like there's an opportunity for some kind organization to help open-source developers out with this. It shouldn't be this hard for someone trying to give away good work to the world. I used Notepad++ for a long time, and still might if I spent any time in Windows.
- tomc1985 8y ago
  I wonder if Lets Encrypt is working on code-signing certs? That would be a huge win for FOSS
  - cm2187 8y ago
    How would let's encrypt verify the identity of the author?
    - ars 8y ago
      They could sign an email address instead of a name.
      - Spivak 8y ago
        Why bother with an email address? You could just punt the identity verification to the domain registrars and sign the domain. I don't really think this scheme would benefit the end user though.
        vbezhenar 8y ago
        I would prefer notepad-plus-plus.org rather than some vague "Notepad, LLC", registered somewhere in the world.
      - vbezhenar 8y ago
        Or just show domain. I think that notepad-plus-plus.org is good enough as an identifier.
    - 8y ago
duxup 8y ago
> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors What does that mean?
kpcyrd 8y ago
It seems the author is very focused on signing with x509. I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Right now there are only checksums but no way to verify they are from the author and are distributed on the same server as the binary, so the only security layer is https.
- mariusmg 8y ago
  >(minus the windows UAC thing) As Windows only project, UAC is the only thing that matters in this equation.
  - kpcyrd 8y ago
    I've just edited my comment to make this clearer. Doing code signing with signify or pgp gives you a way the verify the binary you downloaded is actually the file the developer built on their laptop, even if the webserver is compromised. Linux ISOs are very commonly distributed that way. I agree that it's extremely uncommon for windows users to verify this though.
    - prepend 8y ago
      Windows does not care about non-windows recognized signatures. So this works fine for users who care about gpg verification, but fails the “Windows doesn’t prompt me about insecure stuff” test.
      - someguydave 8y ago
        presumably the user who understands how GPG signing works also doesn't care what windows thinks
- gruez 8y ago
  >I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Main advantage is that authenticode is built into windows and is easy to verify, unlike PGP. Not to mention that the certificates provide some assurance as to who the real author is, unlike PGP where identities could be generated on demand.
blibble 8y ago
register Notepad++ Limited for about £10/$15?
- tonyedgecombe 8y ago
  That comes with a ton of additional bureaucratic work.
  - blibble 8y ago
    in the UK a company takes about 10 minutes to setup and if not actively trading requires about 5 minutes of work per year to keep going
- wcoenen 8y ago
  There isn't even a need for that. Code signing certificates can also be acquired by individuals. For example, TortoiseSVN is signed by Stefan Küng personally (last time I checked).
  - richrichardsson 8y ago
    To do that you need to provide some sort of notarised letter, so that adds more cost to the certificate.
    - imhoguy 8y ago
      Isn't national ID or passport enough for natural person in EU to obtain a qualified certificate?
      - richrichardsson 8y ago
        The whole process is fairly opaque, I wish they would be a bit more transparent about what is involved. I found this : https://www.thesslstore.com/thawte/code-signing-individual.aspx https://www.thesslstore.com/thawte/code-signing-individual.a... > During the validation process, Thawte requires you to present a notarized form that validates some sort of government issued photo identification and take a quick phone call. Don't worry though, this process is easy and we'll provide you with an easy-to-read validation guide after purchase. Why can't they provide the guide ahead of purchase is ridiculous.
fjabre 8y ago
I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These practices are anticompetitive and monopolistic. Good for Notepad++. I couldnt agree more with its sentiment.
- UncleMeat 8y ago
  I am absolutely confident that the overwhelming majority of people have never evaluated the safety of an exe in their life and could not tell you how to do it even if they wanted to. Things that work for security-aware software engineers don't work for billions of people.
  - deleted 8y ago
    [deleted]
- duxup 8y ago
  >I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security experts put out about "only download something you trust" and ignoring that nobody has a clue how to evaluate that aside form say limiting them self to FOSS and reading all the code...
  - zrobotics 8y ago
    >>FOSS and reading all the code... Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.
mc32 8y ago
Microsoft should jump in and afford the developer the cert out of good will given MS until recently never had a good alternative to NP++.
- jvehent 8y ago
  They have Visual Studio Code.
  - skrebbel 8y ago
    > until recently
  - deleted 8y ago
    [deleted]
herf 8y ago
Could post to Microsoft Store, which would let them do this for free.
- jarjoura 8y ago
  I think if I remember correctly, they were opposed going the store route because it took too much effort building on top of the store sandbox and new installer packaging.
- mises 8y ago
  This might be an option, but it's a lot of extra work for only a portion of the users. Only works on Windows 10.
Svoka 8y ago
Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php https://www.digicert.com/order/order-1.php
- Sephr 8y ago
  There's a backdoor that lets your bypass the SmartScreen reputation requirement: pay more money for an EV cert[1]. I don't agree with this industry practice. Reputation requirements either shouldn't have backdoors or shouldn't exist in the first place. 1. https://twitter.com/JosephRyanRies/status/951643158118567937 https://twitter.com/JosephRyanRies/status/951643158118567937
  - Someone1234 8y ago
    The Reputation requirement exists simply because there's CAs in the Windows certificate store that aren't super trustworthy, and frankly that malware could seek to get a code signing certificate. Arguably the Reputation requirement is more helpful than the information held in the certificate, since Reputation is hard to fake whereas that information is provided by the requestor and its validation depends on the CA's processes (which as I said varies wildly). It is one of those "greater good" things. It does suck for FOSS however.
    - Sephr 8y ago
      I'm not arguing against reputation requirements, I'm arguing for consistency. EV certificates are literally a reputation requirement backdoor. If EV-signed apps had to deal with the same SmartScreen reputation requirements as non-EV-signed apps, Microsoft might actually have to address this issue brought up in the parent comment: > Every time you have to get a new one, with same story of "reputation" again.
  - Boulth 8y ago
    EV code signing certs cost more because they require the private key to be stored exclusively on the hardware token so it's harder to misuse.
tabulatouch 8y ago
Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?
- drexlspivey 8y ago
  You don't get to sign a petition for someone else to work for free
  - mises 8y ago
    Maybe OP is willing to help. And in any case, it's still useful. What if he's trying to run a FOSS project and doesn't have $500 for a cert? I would say that's different than someone walking around saying "I want".
  - zamadatix 8y ago
    Who said anything about people working for free? That's not how the example (Let's Encrypt) works so why are you bringing it up now?
- gambler 8y ago
  LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with encryption, so having analogous CA for code would be entirely meaningless. What does code signing in Windows actually verify? That executable's author at some point paid money to some company that Microsoft deemed an "authority"? It's a rotten system. The whole CA pyramid is bullshit. What we really need is a way to know that executable notepad++2.0 is signed by the same person who signed notepad++1.0 already installed on your computer, and that it's the same person who controls notepad-plus-plus.org, and that this identity has existed for well over 10 years. This is legitimately useful info that would allow people to make more informed decisions about what to install. BTW, the part about historic record seems like one of the few good uses for blockchain technology.
  - smarx007 8y ago
    No, it verifies that the certificate was issued to someone whose ID was checked. Money is paid for the covering the bureaucratic costs and keeping the records etc.
vkaku 8y ago
Good for them! Certificates are a bad business today. The only reason I'd get one is because things like letsencrypt exist; Orthogonally, I also think that $99 App Store fees are a terrible waste of money. You should get charged only when submitting to an app store for review. There are plenty of root certificates that came installed on my computer, and I don't even trust them. Why would these CAs charge so much for so little value?
- jmull 8y ago
  I believe Apple has a free tier. There are limitations. It sounds like you'd be fine with some of them, like you can't distribute though the app store. But I think apps you load on your device expire quickly and there are other limitations, so it really is for development, and not a great way to side load apps.
wozer 8y ago
In Germany, Notepad++ is ubiquitous on Windows computers (every developer has it). Is it like this in the US, too?
- NelsonMinar 8y ago
  I'd say it's frequent but not ubiquitous, and less popular than a few years ago. VSCode, Sublime Text, and Atom are all popular as well.
- pzone 8y ago
  My experience is Notepad++ being one of multiple text editors people might choose including Sublime Text, VSCode, Atom, Emacs, vi, etc.
- doorbellguy 8y ago
  Anecdotal evidence here. And I've seen most computers of my friends and colleagues running sublime text. However, notepad ++ is famous too
- wil421 8y ago
  SublimeText is common. I’ve converted a few devs over from Notepad++. A SublimeText license is cheap if you’re in the US/EU but I could see it being expensive for the devolving nations. You can evaluate SublimeText for free and I encourage you to do so. Check out the packages for your stack! After using SublimeText for 5 years, notepad++ is like using a regular notepad but that’s my personal opinion.
- russdpale 8y ago
  In my experience, npp has been surpassed by vscode or atom. however, I have recently found the markdown npp plugin and because of npp's speed, its become my go to markdown editor/viewer. If I need to just edit one file quickly with a simple change, npp is still my go to.
everyone 8y ago
Good on 'im!
JordanBoulan 8y ago
Anyone have any source that cites it's sources for the profit margins on code signing rackets. I imagine for mobile the margins are especially high since phone o/s design makes it much easier to put less effort into audits. I bet the profits margins in both mobile and standard are absolutely monsterous. By the principals of business I assume they put in the least amount of effort possible while still putting in enough to protect themselves from blame
fbelzile 8y ago
I'm going through a "renewal" right now... The archaic maze of validation is also getting on my nerves. It's been three weeks now that I'm waiting for a phone call to validate my phone number. This article is making it so tempting to cancel my order. The plethora of support emails is what motivated me to get one in the first place. I used to get accused of giving users a "virus" and getting into infinite loops on why they should trust me. I'm sure I was wasting more than $100/year of my time responding to these emails, so I just gave in and got one. Now, I don't know what to do.
- ilaksh 8y ago
  Is it k-software/Comodo/Sectigo by any chance?
  - fbelzile 8y ago
    Yes, Sectigo via The SSL Store.
burtonator 8y ago
I created a huge rant on code signing certificates here: https://www.youtube.com/watch?v=mwuk0E-tfeg https://www.youtube.com/watch?v=mwuk0E-tfeg It's a nightmare. Complete scam. I needed this for Polar: https://getpolarized.io/ https://getpolarized.io/ Mind you... it's Open Source but I still want my users to be able to download it without warnings. No joke - it took me 2 weeks to get the CSC with about 4 hours per day working on just this CSC issue. It's just a labyrinth of insanity from not having a listing on D&B to them insisting I pay $2k to expedite it. I still don't have one from Apple because it requires a D&B number so I had to get a personal cert from them. I went with a cheap one for Windows BUT it gives errors on install for like the first 1k downloads until Windows says it's legit. It's a complete scam. BTW.. if you get in the MS App Store you don't have to worry about a CSC so that's good I guess.
- GordonS 8y ago
  Not sure how it managed to take you so long, but I do agree it's a PITA, and pure theatre. I did need to get into D&B, and it was a bit of a faff - their website is a maze, and it took around a week after filling the form to get listed. Didn't need much time on it though. One of the other requirements I had to fulfil was having a telephone number published in a sanctioned list of websites for a callback - so I registered a Skype number, published the number, did the callback, and terminated the number. Not sure what that was meant to prove...
  - juliusmusseau 8y ago
    There might be some risk to your business if a malicious person can get that number assigned to their phone since you're no longer using it.
    - GordonS 8y ago
      Not sure I see how, but it was only listed for 24 hours in any case.
- juliusmusseau 8y ago
  For those that don't know, D&B stands for Dun & Bradstreet (https://www.dnb.com/ https://www.dnb.com/). They have this concept of a D-U-N-S Number which basically means information about your business is in their database. Last I checked expedited D&B was around $40 USD (10 business days) and same-day D&B around $500 USD. Free D&B said it would take 30 business days, but it actually only took them 5 business days when I applied for it.
runarb 8y ago
I am in a similar situation myself with Portable-VirtualBox. Does anyone know where one can get a reasonably priced code signing certificate? Preferably one that does not require a USB dongle. Did order one from Comodo, but was not able to get the USB dongle to work.
billforsternz 8y ago
I've been slowly improving my open source Windows chess program Tarrasch http://triplehappy.com http://triplehappy.com for nearly 10 years. One of my improvement plans has been to put on my big boy pants, and spend the money and time needed to sign the program. I thought it was a big part of the program graduating and becoming a serious software citizen. After reading the comments here I am reconsidering and might save myself the pain. Thanks Hacker News!
crispyambulance 8y ago
Does this mean that some users won't be allowed to install Notepad++ because it's not signed? I know some corporate environments have restrictions on downloaded installers. Off topic, but I have to say that whenever I need to open hundreds of files at once and perform regex operations-- this editor rocks that task like no other. Kudos to Notepad++
- exodust 8y ago
  You might be right, although developers usually have local admin rights, so it should be a matter of clicking past the warnings.
agumonkey 8y ago
Let's see if that affects usage or not. I'm sure people like it so much they won't care.
freedman1611 8y ago
Reading these comments makes me so happy to be a Linux/BSD user. The hoops you guys have to jump through in proprietary land. Wow, pay $$$ to be treated like shit. It's kinda like those guys that hire a dominatrix to belittle them and make them lick her heel, yet they get off on it.
- dang 8y ago
  Could you please stop posting unsubstantive comments and/or flamebait to HN? We're trying for something higher-quality than that on this site. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html
  - freedman1611 8y ago
    As you wish, I'll keep my opinion to myself.
    - dang 8y ago
      The opinion itself and the unsubstantiveness/flamebait are orthogonal. If you'd like to present your opinion in a way that gives the reader information and teaches us something, you're more than welcome. It does take a bit of getting used to, but trading the pleasures of the internet rant for curiosity, which requires more measured conversation, is worth it in the long run. Think of it as a global optimization of the forum, which involves letting go of local optima.
keithnz 8y ago
other than Microsofts signed software, the fact it is signed doesn't really mean much to me as I have no idea what anything should be signed with. What I tend to trust is that I know specifically where I went to get a piece of software. It is easier for me to tell what an official site is rather than an official signature
docode 8y ago
I'm on the same track. Definitely we need Let's Encrypt for code signing certificates!
foobarbazetc 8y ago
In case anyone reads this far down: https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da... Follow the steps under “Buy a DigiCert EV code signing certificate“. You’re welcome. ;)
- fbelzile 8y ago
  I want to personally thank you for this. I cancelled my order with Comodo/SSLStore and followed your suggestion. EV certificate is already in the mail :)
forgery-- 8y ago
Companies using Carbon Black Protection (Bit9) or similar application whitelisting systems use signing certificates to help approve software. Once I approve the "Simon Tatham" certificate for my company, anyone can download the latest version of PuTTY and run it without issue. I wish the trend was for more software to be signed.
newnewpdro 8y ago
This is slightly off-topic, but do indie game developers publishing on Steam have to jump through this hoop to support Windows? Are all Windows games on Steam signed?
joelennon 8y ago
You can buy a Windows code signing certificate from DigiCert for $74/yr (EV certs are $104/yr) by going through this link - https://www.digicert.com/friends/sysdev/ https://www.digicert.com/friends/sysdev/ - much easier to swallow than the standard $499!
xpaulbettsx 8y ago
At the end of the day, Notepad++ can't get a "Notepad++" cert because "Notepad++" is not a Legal Entity (i.e. a corporation or living person). At least from a policy perspective, Microsoft will only consider Legal Entities to be valid code signatories. Yes, this is stupid and outdated, I agree - I personally think that Keybase issuing code signing certificates and being able to verify that the person who signed this also owns this GitHub and that Twitter account would still be super valuable.
arunc 8y ago
These kind of code-signing certificates should be free for free and open source projects. D Language community recently [1][2] bought a certificate reluctantly to satisfy Windows defender, virus scan warning, etc. Sadly we are stuck with this immoral blackmails. [1] https://forum.dlang.org/post/sclqnbggytmyetwrxppb@forum.dlang.org https://forum.dlang.org/post/sclqnbggytmyetwrxppb@forum.dlan... [2]https://dlang.org/changelog/2.082.0.html#signed_windows_binaries https://dlang.org/changelog/2.082.0.html#signed_windows_bina...
laythea 8y ago
I can't be alone in not caring too much about the cert. Notepad++ - Crack on!
Wowfunhappy 8y ago
What really pisses me off is code signing for drivers. To install an unsigned driver in 64-bit Windows 10, you need to reboot your computer into a special menu that can only be navigated with a USB keyboard (which I have to lug out of the closet, since I normally use Bluetooth). That in itself wouldn't be so bad, except the setting persists only until the next reboot! † This is all in stark contrast to macOS's System Integrity Protection, which I can turn off once to never be bothered again. I understand why Microsoft would enforce higher standards on drivers which can touch the kernel. But, the same fundamental problem applies: it isn't reasonable for non-profit, open source developers—many of whom I consider perfectly trustworthy—to pay hundreds of dollars for a certificate! Let me make the final decision about who I trust. It's my machine—I even built it myself! The primary place I run into this problem is with drivers to support weird video game controllers. --- † You can enable a "testsigning" mode via the command line which persists across reboots, but this only seems to work for certain drivers. If anyone can explain why it sometimes works, I'd appreciate it, as my research has never turned up anything.
royce 8y ago
I'm startled that there's no mention of app whitelisting yet. Code signing reduces ops overhead and latency in environments that are using app whitelisting. If the code is signed, then the signing certificate can be trusted once. All upgrades and patches that are signed with that certificate can be automatically whitelisted, with no intervention from teams managing the whitelisting. But if the code isn't signed, then if even a single byte changes in the executable, it must be re-whitelisted - usually manually. The more signed apps there are, the easier it is for companies to start using application whitelisting, the fewer people are needed to maintain it, and the faster patches to those applications can be deployed. Making it easier for companies to move to whitelisting increases security for the ecosystem in the aggregate.
pierotofy 8y ago
Beside the fact that code signing is a racket, https://codesigncert.com/ https://codesigncert.com/ gets you a Comodo cert for $75.

496 points by pmh 8y ago

Why not use something like certum[1]? It's $69/year (cheaper if you already have a smartcard), but the CN ends up with something like "Open source developer, [full name]". It's not "notepad++" like the author wants, but it's still better than nothing. [1] https://en.sklep.certum.pl/data-safety/code-signing-certificates/open-source-code-signing-984.html https://en.sklep.certum.pl/data-safety/code-signing-certific... edit: updated price

velcrovan 8y ago
To attempt an answer of your question "why not", I would say perhaps it's not worth $70 a month for the UAC popup to be blue instead of orange
gpm 8y ago
"It's $828 per year" for ... a cert? What makes code signing this expensive?
- tomc1985 8y ago
  It's an obscure product with few providers
  - criddell 8y ago
    Is code signing part of what you get from Apple for your $99 developer fee? If so, then that suddenly feels like a bargain.
    - morpheuskafka 8y ago
      Yes, that fee includes the ability to sign iOS apps for local distribution and submit them to the App Store, where apple will sign them. On macOS, it also allows code signing for general distribution like Windows has, as well as App Store submissions. I think the issue most people have with the price is that on iOS there's way more limits on running locally without a cert (7 days max), but for someone who is a practicing developer it's really a pretty low cost. If only it came with a mac to develop on...
      - baroffoos 8y ago
        >but for someone who is a practicing developer it's really a pretty low cost. Hah! I don't know about you but when I first started app development I didn't even have a credit card, let alone $99 on it to spend. Thankfully I could install my apps on android for free.
    - WorldMaker 8y ago
      It's also a part of Microsoft Store development fees (similarly $99 last I checked), if you release through the Store all code signing is handled through the Store.
- eps 8y ago
  Greed, mostly. Digicert lists EV code signing certs as $664/yr. But if you are to enter their site through a side door or just plainly cry into the support's jacket, then the price magically drops to $104/yr. And that's for an EV cert! So the only reason there are $600 certs is that there are people who do pay that.
  - jlongster 8y ago
    Yeah, I about an EV cert from digicert for ~$100/year. People pay >$600/year?? What? I never even saw those prices! Not sure how I landed on digicert but I think it was a Microsoft article listing where to get EV certs.
  - docode 8y ago
    And where is this sidedoor?
- pishpash 8y ago
  It's businesses' customers who find more than $828/yr of value collectively in seeing a certain icon.
garaetjjte 8y ago
It's 25€ yearly. (store page states that it requires Certum smartcard, but any card supported by Windows works, including windows virtual smartcards)
- gruez 8y ago
  thanks, fixed.
MikusR 8y ago
If you are wiling to sponsor it, contact the author.
deleted 8y ago
[deleted]
jacekm 8y ago
They've already tried it https://twitter.com/Notepad_plus/status/1098519332852822016 https://twitter.com/Notepad_plus/status/1098519332852822016
- gruez 8y ago
  If you read further down (https://twitter.com/Notepad_plus/status/1098553736656572416 https://twitter.com/Notepad_plus/status/1098553736656572416), you find out it's because certum didn't allow them to use "notepad++" as the CN (probably because it's not a valid legal entity).
pornel 8y ago
It's nice they support FOSS, but both the CA process and Microsoft's tooling for this are stuck in the year 1999: • The registration process is painfully manual (including e-mailing scanned documents). It's like an "Enterprise" CA from before Let's Encrypt. • The website wouldn't send the final cert to any browser other than Internet Explorer. • Microsoft's signing tools are a hot garbage. All options default to "subtly wrong". To get a working signature you need a half dozen flags in an exact order, different from what the official documentation uses. • Microsoft's docs are either: a) plentiful but only tangentially related vague introduction, or b) scraps of incomplete technical information, mainly for Windows XP only. It's as if they've tried to improve it many times, but every time gave up after rewriting the first chapter. • Signing can't be automated or used remotely, because its weirdo software wants a PIN entered from the local keyboard.

asveikau 8y ago

Interesting that they will check the hashes of dependencies at runtime. But then I start to wonder - why dynamic linking if the library can't be replaced?

criddell 8y ago
Why bother checking the signature of dependencies if the main executable integrity isn't being checked? What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.
- asveikau 8y ago
  I suppose we could all demand a refund. Edit: downvoted? The project is GPL, not a revenue source.
- mattnewport 8y ago
  Price doesn't seem to be his primary issue.
- magnat 8y ago
  It's not about the price, but about name on the certificate: > However I cannot use "Notepad++" as CN to sign because Notepad++ doesn’t exist as company or organization CAs would put author's name as CN, which isn't great, especially for collaborative project.
  - techsupporter 8y ago
    Yep and sometimes the name people know isn't the name that a CA will permit in a certificate. I have one of those. I'm known as a shortened version of my middle name, say Jack Quimby, but DigiCert and others insist that the cert be issued to Alphonse Jackson Quimby, Jr. OK I'll just buy an LLC from a state that's cheap (never mind the paperwork) but that's no good either because the new entity had no listed phone number...

jimktrains2 8y ago

> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors. I'm not sure what the author means by this.

daveFNbuck 8y ago
The author is saying that signing certificates are something that FOSS authors enjoy using, but they have no practical purpose outside of that enjoyment.
- SmellyGeekBoy 8y ago
  I don't know, getting rid of the huge "YOU MAY BE INSTALLING DANGEROUS SOFTWARE" warning in Windows 10 seems like a practical purpose.
  - mikewhy 8y ago
    For that you need to shell out even more for an EV Cert. If you just have a regular cert, people are still warned when running your app.
    - Leace 8y ago
      "are still warned" for ~ 2 weeks, then it is trusted: https://news.ycombinator.com/item?id=19330564 https://news.ycombinator.com/item?id=19330564
- jimktrains2 8y ago
  I guess I haven't used systems with code signing like this. Is it really that common?
tomc1985 8y ago
Codesigning certs are a racket... the 'chain of trust' and documentation requirements mean they are expensive and hard to get as an individual, yet oh-so-essential for releasing software. Which also makes them status symbols, which the author is rejecting. I kind of see them like taxi medallions

draw_down 8y ago

Feels like there's an opportunity for some kind organization to help open-source developers out with this. It shouldn't be this hard for someone trying to give away good work to the world. I used Notepad++ for a long time, and still might if I spent any time in Windows.

tomc1985 8y ago
I wonder if Lets Encrypt is working on code-signing certs? That would be a huge win for FOSS
- cm2187 8y ago
  How would let's encrypt verify the identity of the author?
  - ars 8y ago
    They could sign an email address instead of a name.
    - Spivak 8y ago
      Why bother with an email address? You could just punt the identity verification to the domain registrars and sign the domain. I don't really think this scheme would benefit the end user though.
      - vbezhenar 8y ago
        I would prefer notepad-plus-plus.org rather than some vague "Notepad, LLC", registered somewhere in the world.
    - vbezhenar 8y ago
      Or just show domain. I think that notepad-plus-plus.org is good enough as an identifier.
  - 8y ago

duxup 8y ago

> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors What does that mean?

kpcyrd 8y ago

It seems the author is very focused on signing with x509. I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Right now there are only checksums but no way to verify they are from the author and are distributed on the same server as the binary, so the only security layer is https.

mariusmg 8y ago
>(minus the windows UAC thing) As Windows only project, UAC is the only thing that matters in this equation.
- kpcyrd 8y ago
  I've just edited my comment to make this clearer. Doing code signing with signify or pgp gives you a way the verify the binary you downloaded is actually the file the developer built on their laptop, even if the webserver is compromised. Linux ISOs are very commonly distributed that way. I agree that it's extremely uncommon for windows users to verify this though.
  - prepend 8y ago
    Windows does not care about non-windows recognized signatures. So this works fine for users who care about gpg verification, but fails the “Windows doesn’t prompt me about insecure stuff” test.
    - someguydave 8y ago
      presumably the user who understands how GPG signing works also doesn't care what windows thinks
gruez 8y ago
>I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Main advantage is that authenticode is built into windows and is easy to verify, unlike PGP. Not to mention that the certificates provide some assurance as to who the real author is, unlike PGP where identities could be generated on demand.

blibble 8y ago

tonyedgecombe 8y ago
That comes with a ton of additional bureaucratic work.
- blibble 8y ago
  in the UK a company takes about 10 minutes to setup and if not actively trading requires about 5 minutes of work per year to keep going
wcoenen 8y ago
There isn't even a need for that. Code signing certificates can also be acquired by individuals. For example, TortoiseSVN is signed by Stefan Küng personally (last time I checked).
- richrichardsson 8y ago
  To do that you need to provide some sort of notarised letter, so that adds more cost to the certificate.
  - imhoguy 8y ago
    Isn't national ID or passport enough for natural person in EU to obtain a qualified certificate?
    - richrichardsson 8y ago
      The whole process is fairly opaque, I wish they would be a bit more transparent about what is involved. I found this : https://www.thesslstore.com/thawte/code-signing-individual.aspx https://www.thesslstore.com/thawte/code-signing-individual.a... > During the validation process, Thawte requires you to present a notarized form that validates some sort of government issued photo identification and take a quick phone call. Don't worry though, this process is easy and we'll provide you with an easy-to-read validation guide after purchase. Why can't they provide the guide ahead of purchase is ridiculous.

fjabre 8y ago

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These practices are anticompetitive and monopolistic. Good for Notepad++. I couldnt agree more with its sentiment.

UncleMeat 8y ago
I am absolutely confident that the overwhelming majority of people have never evaluated the safety of an exe in their life and could not tell you how to do it even if they wanted to. Things that work for security-aware software engineers don't work for billions of people.
- deleted 8y ago
  [deleted]
duxup 8y ago
>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security experts put out about "only download something you trust" and ignoring that nobody has a clue how to evaluate that aside form say limiting them self to FOSS and reading all the code...
- zrobotics 8y ago
  >>FOSS and reading all the code... Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.

mc32 8y ago

Microsoft should jump in and afford the developer the cert out of good will given MS until recently never had a good alternative to NP++.

jvehent 8y ago
They have Visual Studio Code.
- skrebbel 8y ago
  > until recently
- deleted 8y ago
  [deleted]

herf 8y ago

Could post to Microsoft Store, which would let them do this for free.

jarjoura 8y ago
I think if I remember correctly, they were opposed going the store route because it took too much effort building on top of the store sandbox and new installer packaging.
mises 8y ago
This might be an option, but it's a lot of extra work for only a portion of the users. Only works on Windows 10.

Svoka 8y ago

Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings. Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again. [1] https://www.digicert.com/order/order-1.php https://www.digicert.com/order/order-1.php

Sephr 8y ago
There's a backdoor that lets your bypass the SmartScreen reputation requirement: pay more money for an EV cert[1]. I don't agree with this industry practice. Reputation requirements either shouldn't have backdoors or shouldn't exist in the first place. 1. https://twitter.com/JosephRyanRies/status/951643158118567937 https://twitter.com/JosephRyanRies/status/951643158118567937
- Someone1234 8y ago
  The Reputation requirement exists simply because there's CAs in the Windows certificate store that aren't super trustworthy, and frankly that malware could seek to get a code signing certificate. Arguably the Reputation requirement is more helpful than the information held in the certificate, since Reputation is hard to fake whereas that information is provided by the requestor and its validation depends on the CA's processes (which as I said varies wildly). It is one of those "greater good" things. It does suck for FOSS however.
  - Sephr 8y ago
    I'm not arguing against reputation requirements, I'm arguing for consistency. EV certificates are literally a reputation requirement backdoor. If EV-signed apps had to deal with the same SmartScreen reputation requirements as non-EV-signed apps, Microsoft might actually have to address this issue brought up in the parent comment: > Every time you have to get a new one, with same story of "reputation" again.
- Boulth 8y ago
  EV code signing certs cost more because they require the private key to be stored exclusively on the hardware token so it's harder to misuse.

tabulatouch 8y ago

Where do I sign for a petition to have a free CA like LetsEncrypt for Code Signing?

drexlspivey 8y ago
You don't get to sign a petition for someone else to work for free
- mises 8y ago
  Maybe OP is willing to help. And in any case, it's still useful. What if he's trying to run a FOSS project and doesn't have $500 for a cert? I would say that's different than someone walking around saying "I want".
- zamadatix 8y ago
  Who said anything about people working for free? That's not how the example (Let's Encrypt) works so why are you bringing it up now?
gambler 8y ago
LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with encryption, so having analogous CA for code would be entirely meaningless. What does code signing in Windows actually verify? That executable's author at some point paid money to some company that Microsoft deemed an "authority"? It's a rotten system. The whole CA pyramid is bullshit. What we really need is a way to know that executable notepad++2.0 is signed by the same person who signed notepad++1.0 already installed on your computer, and that it's the same person who controls notepad-plus-plus.org, and that this identity has existed for well over 10 years. This is legitimately useful info that would allow people to make more informed decisions about what to install. BTW, the part about historic record seems like one of the few good uses for blockchain technology.
- smarx007 8y ago
  No, it verifies that the certificate was issued to someone whose ID was checked. Money is paid for the covering the bureaucratic costs and keeping the records etc.

vkaku 8y ago

Good for them! Certificates are a bad business today. The only reason I'd get one is because things like letsencrypt exist; Orthogonally, I also think that $99 App Store fees are a terrible waste of money. You should get charged only when submitting to an app store for review. There are plenty of root certificates that came installed on my computer, and I don't even trust them. Why would these CAs charge so much for so little value?

jmull 8y ago
I believe Apple has a free tier. There are limitations. It sounds like you'd be fine with some of them, like you can't distribute though the app store. But I think apps you load on your device expire quickly and there are other limitations, so it really is for development, and not a great way to side load apps.

wozer 8y ago

In Germany, Notepad++ is ubiquitous on Windows computers (every developer has it). Is it like this in the US, too?

NelsonMinar 8y ago
I'd say it's frequent but not ubiquitous, and less popular than a few years ago. VSCode, Sublime Text, and Atom are all popular as well.
pzone 8y ago
My experience is Notepad++ being one of multiple text editors people might choose including Sublime Text, VSCode, Atom, Emacs, vi, etc.
doorbellguy 8y ago
Anecdotal evidence here. And I've seen most computers of my friends and colleagues running sublime text. However, notepad ++ is famous too
wil421 8y ago
SublimeText is common. I’ve converted a few devs over from Notepad++. A SublimeText license is cheap if you’re in the US/EU but I could see it being expensive for the devolving nations. You can evaluate SublimeText for free and I encourage you to do so. Check out the packages for your stack! After using SublimeText for 5 years, notepad++ is like using a regular notepad but that’s my personal opinion.
russdpale 8y ago
In my experience, npp has been surpassed by vscode or atom. however, I have recently found the markdown npp plugin and because of npp's speed, its become my go to markdown editor/viewer. If I need to just edit one file quickly with a simple change, npp is still my go to.

everyone 8y ago

Good on 'im!

JordanBoulan 8y ago

Anyone have any source that cites it's sources for the profit margins on code signing rackets. I imagine for mobile the margins are especially high since phone o/s design makes it much easier to put less effort into audits. I bet the profits margins in both mobile and standard are absolutely monsterous. By the principals of business I assume they put in the least amount of effort possible while still putting in enough to protect themselves from blame

fbelzile 8y ago

I'm going through a "renewal" right now... The archaic maze of validation is also getting on my nerves. It's been three weeks now that I'm waiting for a phone call to validate my phone number. This article is making it so tempting to cancel my order. The plethora of support emails is what motivated me to get one in the first place. I used to get accused of giving users a "virus" and getting into infinite loops on why they should trust me. I'm sure I was wasting more than $100/year of my time responding to these emails, so I just gave in and got one. Now, I don't know what to do.

ilaksh 8y ago
Is it k-software/Comodo/Sectigo by any chance?
- fbelzile 8y ago
  Yes, Sectigo via The SSL Store.

burtonator 8y ago

I created a huge rant on code signing certificates here: https://www.youtube.com/watch?v=mwuk0E-tfeg https://www.youtube.com/watch?v=mwuk0E-tfeg It's a nightmare. Complete scam. I needed this for Polar: https://getpolarized.io/ https://getpolarized.io/ Mind you... it's Open Source but I still want my users to be able to download it without warnings. No joke - it took me 2 weeks to get the CSC with about 4 hours per day working on just this CSC issue. It's just a labyrinth of insanity from not having a listing on D&B to them insisting I pay $2k to expedite it. I still don't have one from Apple because it requires a D&B number so I had to get a personal cert from them. I went with a cheap one for Windows BUT it gives errors on install for like the first 1k downloads until Windows says it's legit. It's a complete scam. BTW.. if you get in the MS App Store you don't have to worry about a CSC so that's good I guess.

GordonS 8y ago
Not sure how it managed to take you so long, but I do agree it's a PITA, and pure theatre. I did need to get into D&B, and it was a bit of a faff - their website is a maze, and it took around a week after filling the form to get listed. Didn't need much time on it though. One of the other requirements I had to fulfil was having a telephone number published in a sanctioned list of websites for a callback - so I registered a Skype number, published the number, did the callback, and terminated the number. Not sure what that was meant to prove...
- juliusmusseau 8y ago
  There might be some risk to your business if a malicious person can get that number assigned to their phone since you're no longer using it.
  - GordonS 8y ago
    Not sure I see how, but it was only listed for 24 hours in any case.
juliusmusseau 8y ago
For those that don't know, D&B stands for Dun & Bradstreet (https://www.dnb.com/ https://www.dnb.com/). They have this concept of a D-U-N-S Number which basically means information about your business is in their database. Last I checked expedited D&B was around $40 USD (10 business days) and same-day D&B around $500 USD. Free D&B said it would take 30 business days, but it actually only took them 5 business days when I applied for it.

runarb 8y ago

I am in a similar situation myself with Portable-VirtualBox. Does anyone know where one can get a reasonably priced code signing certificate? Preferably one that does not require a USB dongle. Did order one from Comodo, but was not able to get the USB dongle to work.

billforsternz 8y ago

I've been slowly improving my open source Windows chess program Tarrasch http://triplehappy.com http://triplehappy.com for nearly 10 years. One of my improvement plans has been to put on my big boy pants, and spend the money and time needed to sign the program. I thought it was a big part of the program graduating and becoming a serious software citizen. After reading the comments here I am reconsidering and might save myself the pain. Thanks Hacker News!

crispyambulance 8y ago

Does this mean that some users won't be allowed to install Notepad++ because it's not signed? I know some corporate environments have restrictions on downloaded installers. Off topic, but I have to say that whenever I need to open hundreds of files at once and perform regex operations-- this editor rocks that task like no other. Kudos to Notepad++

exodust 8y ago
You might be right, although developers usually have local admin rights, so it should be a matter of clicking past the warnings.

agumonkey 8y ago

Let's see if that affects usage or not. I'm sure people like it so much they won't care.

freedman1611 8y ago

Reading these comments makes me so happy to be a Linux/BSD user. The hoops you guys have to jump through in proprietary land. Wow, pay $$$ to be treated like shit. It's kinda like those guys that hire a dominatrix to belittle them and make them lick her heel, yet they get off on it.

dang 8y ago
Could you please stop posting unsubstantive comments and/or flamebait to HN? We're trying for something higher-quality than that on this site. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html
- freedman1611 8y ago
  As you wish, I'll keep my opinion to myself.
  - dang 8y ago
    The opinion itself and the unsubstantiveness/flamebait are orthogonal. If you'd like to present your opinion in a way that gives the reader information and teaches us something, you're more than welcome. It does take a bit of getting used to, but trading the pleasures of the internet rant for curiosity, which requires more measured conversation, is worth it in the long run. Think of it as a global optimization of the forum, which involves letting go of local optima.

keithnz 8y ago

other than Microsofts signed software, the fact it is signed doesn't really mean much to me as I have no idea what anything should be signed with. What I tend to trust is that I know specifically where I went to get a piece of software. It is easier for me to tell what an official site is rather than an official signature

docode 8y ago

I'm on the same track. Definitely we need Let's Encrypt for code signing certificates!

foobarbazetc 8y ago

In case anyone reads this far down: https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da... Follow the steps under “Buy a DigiCert EV code signing certificate“. You’re welcome. ;)

fbelzile 8y ago
I want to personally thank you for this. I cancelled my order with Comodo/SSLStore and followed your suggestion. EV certificate is already in the mail :)

forgery-- 8y ago

Companies using Carbon Black Protection (Bit9) or similar application whitelisting systems use signing certificates to help approve software. Once I approve the "Simon Tatham" certificate for my company, anyone can download the latest version of PuTTY and run it without issue. I wish the trend was for more software to be signed.

newnewpdro 8y ago

This is slightly off-topic, but do indie game developers publishing on Steam have to jump through this hoop to support Windows? Are all Windows games on Steam signed?

joelennon 8y ago

You can buy a Windows code signing certificate from DigiCert for $74/yr (EV certs are $104/yr) by going through this link - https://www.digicert.com/friends/sysdev/ https://www.digicert.com/friends/sysdev/ - much easier to swallow than the standard $499!

xpaulbettsx 8y ago

At the end of the day, Notepad++ can't get a "Notepad++" cert because "Notepad++" is not a Legal Entity (i.e. a corporation or living person). At least from a policy perspective, Microsoft will only consider Legal Entities to be valid code signatories. Yes, this is stupid and outdated, I agree - I personally think that Keybase issuing code signing certificates and being able to verify that the person who signed this also owns this GitHub and that Twitter account would still be super valuable.

arunc 8y ago

These kind of code-signing certificates should be free for free and open source projects. D Language community recently [1][2] bought a certificate reluctantly to satisfy Windows defender, virus scan warning, etc. Sadly we are stuck with this immoral blackmails. [1] https://forum.dlang.org/post/sclqnbggytmyetwrxppb@forum.dlang.org https://forum.dlang.org/post/sclqnbggytmyetwrxppb@forum.dlan... [2]https://dlang.org/changelog/2.082.0.html#signed_windows_binaries https://dlang.org/changelog/2.082.0.html#signed_windows_bina...

laythea 8y ago

I can't be alone in not caring too much about the cert. Notepad++ - Crack on!

Wowfunhappy 8y ago

What really pisses me off is code signing for drivers. To install an unsigned driver in 64-bit Windows 10, you need to reboot your computer into a special menu that can only be navigated with a USB keyboard (which I have to lug out of the closet, since I normally use Bluetooth). That in itself wouldn't be so bad, except the setting persists only until the next reboot! † This is all in stark contrast to macOS's System Integrity Protection, which I can turn off once to never be bothered again. I understand why Microsoft would enforce higher standards on drivers which can touch the kernel. But, the same fundamental problem applies: it isn't reasonable for non-profit, open source developers—many of whom I consider perfectly trustworthy—to pay hundreds of dollars for a certificate! Let me make the final decision about who I trust. It's my machine—I even built it myself! The primary place I run into this problem is with drivers to support weird video game controllers. --- † You can enable a "testsigning" mode via the command line which persists across reboots, but this only seems to work for certain drivers. If anyone can explain why it sometimes works, I'd appreciate it, as my research has never turned up anything.

royce 8y ago

I'm startled that there's no mention of app whitelisting yet. Code signing reduces ops overhead and latency in environments that are using app whitelisting. If the code is signed, then the signing certificate can be trusted once. All upgrades and patches that are signed with that certificate can be automatically whitelisted, with no intervention from teams managing the whitelisting. But if the code isn't signed, then if even a single byte changes in the executable, it must be re-whitelisted - usually manually. The more signed apps there are, the easier it is for companies to start using application whitelisting, the fewer people are needed to maintain it, and the faster patches to those applications can be deployed. Making it easier for companies to move to whitelisting increases security for the ecosystem in the aggregate.

pierotofy 8y ago

Beside the fact that code signing is a racket, https://codesigncert.com/ https://codesigncert.com/ gets you a Comodo cert for $75.