3 ms·

It seems the author is very focused on signing with x509. I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well

by kpcyrd 8y ago

It seems the author is very focused on signing with x509. I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Right now there are only checksums but no way to verify they are from the author and are distributed on the same server as the binary, so the only security layer is https.

mariusmg 8y ago
>(minus the windows UAC thing) As Windows only project, UAC is the only thing that matters in this equation.
- kpcyrd 8y ago
  I've just edited my comment to make this clearer. Doing code signing with signify or pgp gives you a way the verify the binary you downloaded is actually the file the developer built on their laptop, even if the webserver is compromised. Linux ISOs are very commonly distributed that way. I agree that it's extremely uncommon for windows users to verify this though.
  - prepend 8y ago
    Windows does not care about non-windows recognized signatures. So this works fine for users who care about gpg verification, but fails the “Windows doesn’t prompt me about insecure stuff” test.
    - someguydave 8y ago
      presumably the user who understands how GPG signing works also doesn't care what windows thinks
gruez 8y ago
>I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Main advantage is that authenticode is built into windows and is easy to verify, unlike PGP. Not to mention that the certificates provide some assurance as to who the real author is, unlike PGP where identities could be generated on demand.
ratling 8y ago
UAC and Gatekeeper are the only things that matter. If it's not supported by those two services it's not worth doing.
GordonS 8y ago
> would work just as well (minus the windows UAC thing) The blue UAC prompt and no warning message is the main point, though. In theory users could manually verify a PGP-signed executable, but that's well outside of the average Windows user's knowledge.
NelsonMinar 8y ago
In what way would PGP "work just as well" for a Windows user? You say "minus the windows UAC thing" as if that's an afterthought: it's the whole point of code signing on Windows.

by kpcyrd 8y ago

mariusmg 8y ago

>(minus the windows UAC thing) As Windows only project, UAC is the only thing that matters in this equation.

kpcyrd 8y ago
I've just edited my comment to make this clearer. Doing code signing with signify or pgp gives you a way the verify the binary you downloaded is actually the file the developer built on their laptop, even if the webserver is compromised. Linux ISOs are very commonly distributed that way. I agree that it's extremely uncommon for windows users to verify this though.
- prepend 8y ago
  Windows does not care about non-windows recognized signatures. So this works fine for users who care about gpg verification, but fails the “Windows doesn’t prompt me about insecure stuff” test.
  - someguydave 8y ago
    presumably the user who understands how GPG signing works also doesn't care what windows thinks

gruez 8y ago

>I'm wondering if they are aware of free alternatives like signify or pgp that would work just as well (minus the windows UAC thing). Main advantage is that authenticode is built into windows and is easy to verify, unlike PGP. Not to mention that the certificates provide some assurance as to who the real author is, unlike PGP where identities could be generated on demand.

ratling 8y ago

UAC and Gatekeeper are the only things that matter. If it's not supported by those two services it's not worth doing.

GordonS 8y ago

> would work just as well (minus the windows UAC thing) The blue UAC prompt and no warning message is the main point, though. In theory users could manually verify a PGP-signed executable, but that's well outside of the average Windows user's knowledge.

NelsonMinar 8y ago

In what way would PGP "work just as well" for a Windows user? You say "minus the windows UAC thing" as if that's an afterthought: it's the whole point of code signing on Windows.