3 ms·
Feels like there's an opportunity for some kind organization to help open-source developers out with this. It shouldn't be this hard for someone trying to give
by draw_down 8y ago
Feels like there's an opportunity for some kind organization to help open-source developers out with this. It shouldn't be this hard for someone trying to give away good work to the world. I used Notepad++ for a long time, and still might if I spent any time in Windows.
- tomc1985 8y agoI wonder if Lets Encrypt is working on code-signing certs? That would be a huge win for FOSS
- cm2187 8y agoHow would let's encrypt verify the identity of the author?
- ars 8y agoThey could sign an email address instead of a name.
- Spivak 8y agoWhy bother with an email address? You could just punt the identity verification to the domain registrars and sign the domain. I don't really think this scheme would benefit the end user though.
- vbezhenar 8y agoI would prefer notepad-plus-plus.org rather than some vague "Notepad, LLC", registered somewhere in the world.
- vbezhenar 8y agoOr just show domain. I think that notepad-plus-plus.org is good enough as an identifier.
- tomc1985 8y agoWhy must identity be an essential part? It's just a private key.
- cm2187 8y agoThe key has no value if anyone can sign the binaries in the name of the developper. Then the binaries might as well not be signed.
- tomc1985 8y agoNot really. The point of origin is the private key, which does need to be protected. Lack of identity verification might make key revocation/rotation more difficult, but identity is not really permanently coupled to the keypair. If that were true then why is the only thing stopping me from circulating self-signed certificates with bogus info the lack of a CA signature?
- cm2187 8y agoWell, that's the whole point, windows doesn't accept self-signed certificates. It has to be signed by a CA. And to know you are executing the code from the original developer as opposed to some repackaging by a malware, you need to be able to observe the identity as stated by the CA, and it has to be meaningful to you (a function in the browser performed by you having typed the domain name of the website). If anyone can get a certificate from a reputable CA under the name of Microsoft Inc, then how do you know you are executing guenine Microsoft code? You don't have the public key of every reputable developer installed on your machine, and the CA won't check for reputability or malware, just that the identity is who the certificate claims it is.
- Leace 8y agoThe answer to your question: https://community.letsencrypt.org/t/do-you-support-code-signing/370/16 https://community.letsencrypt.org/t/do-you-support-code-sign...