4 ms·

> I realize that code signing certificate is just an overpriced masturbating toy of FOSS authors. I'm not sure what the author means by this.

daveFNbuck 8y ago
The author is saying that signing certificates are something that FOSS authors enjoy using, but they have no practical purpose outside of that enjoyment.
- SmellyGeekBoy 8y ago
  I don't know, getting rid of the huge "YOU MAY BE INSTALLING DANGEROUS SOFTWARE" warning in Windows 10 seems like a practical purpose.
  - mikewhy 8y ago
    For that you need to shell out even more for an EV Cert. If you just have a regular cert, people are still warned when running your app.
    - Leace 8y ago
      "are still warned" for ~ 2 weeks, then it is trusted: https://news.ycombinator.com/item?id=19330564 https://news.ycombinator.com/item?id=19330564
- jimktrains2 8y ago
  I guess I haven't used systems with code signing like this. Is it really that common?
tomc1985 8y ago
Codesigning certs are a racket... the 'chain of trust' and documentation requirements mean they are expensive and hard to get as an individual, yet oh-so-essential for releasing software. Which also makes them status symbols, which the author is rejecting. I kind of see them like taxi medallions
- gruez 8y ago
  >I kind of see them like taxi medallions Taxi medallions are pricey because there's limited supply and high demand. Code signing certificates have limited demand and unlimited supply, but are expensive because they require manual verification (like EV certificates) and has a bunch of startup costs (to get included as a root).
  - tomc1985 8y ago
    Factors keep both items expensive, and both are effectively required for doing certain types of business.
    - cwyers 8y ago
      Medallions are an artificial constraint on supply -- the point of them is to shrink the market. Code signing provides a benefit -- it's a way for a user to ensure they have the right installer and that it wasn't changed by a nefarious third party.
      - tomc1985 8y ago
        And are code-signing certs really so different? The reporting and regulatory requirements behind them make me think that they are an intentional barrier-to-entry for newcomers, amateurs, and startups, and the business student in me admires their moat-like quality. Code-signing certs lock a lot of people out of certain channels of software distribution
- ratling 8y ago
  The one place they have value is for people who have macbooks that are locked down to only allow app store/signed dmgs to run. TBH though since corp control of OSX is janky to begin with devs will usually figure out a workaround (or scream loud enough that this gets reverted, no one likes to pay for devs to sit around doing nothing).
kevwil 8y ago
Yeah, if this is about Windows UAC and cert/app naming problems, how is that related to FOSS whatsoever? Seems like a whiney rant that shouldn't have been made public.
lucb1e 8y ago
I don't get it either. If you replace the word "FOSS authors" with "big corporations", then sure. But specifically FOSS authors are the kind of people that don't ask money for it -- all of Debian (thousands of software packages just like Notepad++) are signed, but nobody is paying anyone a penny for it... I really don't get how a FOSS author blames FOSS authors?! The problem is clearly with Microsoft and many FOSS authors don't bother and just sign it with their own, web-of-trust'ed PGP keys.

daveFNbuck 8y ago

The author is saying that signing certificates are something that FOSS authors enjoy using, but they have no practical purpose outside of that enjoyment.

SmellyGeekBoy 8y ago
I don't know, getting rid of the huge "YOU MAY BE INSTALLING DANGEROUS SOFTWARE" warning in Windows 10 seems like a practical purpose.
- mikewhy 8y ago
  For that you need to shell out even more for an EV Cert. If you just have a regular cert, people are still warned when running your app.
  - Leace 8y ago
    "are still warned" for ~ 2 weeks, then it is trusted: https://news.ycombinator.com/item?id=19330564 https://news.ycombinator.com/item?id=19330564
jimktrains2 8y ago
I guess I haven't used systems with code signing like this. Is it really that common?

tomc1985 8y ago

Codesigning certs are a racket... the 'chain of trust' and documentation requirements mean they are expensive and hard to get as an individual, yet oh-so-essential for releasing software. Which also makes them status symbols, which the author is rejecting. I kind of see them like taxi medallions

gruez 8y ago
>I kind of see them like taxi medallions Taxi medallions are pricey because there's limited supply and high demand. Code signing certificates have limited demand and unlimited supply, but are expensive because they require manual verification (like EV certificates) and has a bunch of startup costs (to get included as a root).
- tomc1985 8y ago
  Factors keep both items expensive, and both are effectively required for doing certain types of business.
  - cwyers 8y ago
    Medallions are an artificial constraint on supply -- the point of them is to shrink the market. Code signing provides a benefit -- it's a way for a user to ensure they have the right installer and that it wasn't changed by a nefarious third party.
    - tomc1985 8y ago
      And are code-signing certs really so different? The reporting and regulatory requirements behind them make me think that they are an intentional barrier-to-entry for newcomers, amateurs, and startups, and the business student in me admires their moat-like quality. Code-signing certs lock a lot of people out of certain channels of software distribution
ratling 8y ago
The one place they have value is for people who have macbooks that are locked down to only allow app store/signed dmgs to run. TBH though since corp control of OSX is janky to begin with devs will usually figure out a workaround (or scream loud enough that this gets reverted, no one likes to pay for devs to sit around doing nothing).

kevwil 8y ago

Yeah, if this is about Windows UAC and cert/app naming problems, how is that related to FOSS whatsoever? Seems like a whiney rant that shouldn't have been made public.

lucb1e 8y ago

I don't get it either. If you replace the word "FOSS authors" with "big corporations", then sure. But specifically FOSS authors are the kind of people that don't ask money for it -- all of Debian (thousands of software packages just like Notepad++) are signed, but nobody is paying anyone a penny for it... I really don't get how a FOSS author blames FOSS authors?! The problem is clearly with Microsoft and many FOSS authors don't bother and just sign it with their own, web-of-trust'ed PGP keys.