10 ms·

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app

by fjabre 8y ago

I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Now all we have are app store and certificate rackets. Im looking at Google and Apple too. Shame on the industry for accepting 30% revenue share on their services. The idea of an app store is great but not when it excludes other legitimate ways of installing software on device. These practices are anticompetitive and monopolistic. Good for Notepad++. I couldnt agree more with its sentiment.

UncleMeat 8y ago
I am absolutely confident that the overwhelming majority of people have never evaluated the safety of an exe in their life and could not tell you how to do it even if they wanted to. Things that work for security-aware software engineers don't work for billions of people.
- deleted 8y ago
  [deleted]
duxup 8y ago
>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security experts put out about "only download something you trust" and ignoring that nobody has a clue how to evaluate that aside form say limiting them self to FOSS and reading all the code...
- zrobotics 8y ago
  >>FOSS and reading all the code... Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.
  - lghh 8y ago
    And also trust yourself to have a better idea than the devs do about security. Most flaws are accidents and accidents can be hard to catch.
  - fjabre 8y ago
    Every good dev knows to stay the hell away from sourceforge!
    - throwawaymath 8y ago
      Only if that's part of your definition of a good dev. I know plenty of good devs who downloaded software from Sourceforge back when it was big. Let me guess: you also dislike GitHub because it's closed, and wish people would distribute software from their own, self-hosted git repositories?
      - thanksDr 8y ago
        Devs get better by learning from mistakes. Sourceforge is a hostile source of malware : https://mail.gnome.org/archives/gimp-developer-list/2015-May/msg00144.html https://mail.gnome.org/archives/gimp-developer-list/2015-May... You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast.
        detaro 8y ago
        was, not is. Sourceforge has changed hands since then.
        duxup 8y ago
        Yeah my understanding is after it changed hands they did away with all the nasty stuff that happened in the past.
        throwawaymath 8y ago
        > You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast. Oh no, it's the 90s and Micro$oft is evil! They're going to embrace, extend, extinguish all my open source software! I won't be free to develop software anymore! I'm quite happy with Microsoft, and if supporting GitHub "feeds the beast", then I'm likewise happy to see that beast well-fed.
- fjabre 8y ago
  Of course but all of the above mentioned can still happen and does happen today with all security measures in place. With the added benefit that we must ask permission of a private entity to release an app and we must pay 30% of our profits to the gatekeepers /s I think I like the old way better.
  - duxup 8y ago
    I don't think I understand what the difference is with the "old way" if as you describe it ... there seems to be no difference. You don't have to pay some cert provider under the old or current way.
    - fjabre 8y ago
      You do if you want your app not to be flagged as spam. Users are perceptive. They notice when windows brings up a big notice telling them the app is not to be trusted. Perception is everything in those first few moments a user get his hands on your software. But now if I dont pay the entrance fee I potentially get abandoned by said user bc they have been scared off. Its not an app store yet. Give it 5 or 10 years when we no longer have an open web and all we have are walled gardens.
  - throwawaymath 8y ago
    You don't have to do anything you don't want to. No one is forcing you to develop for those platforms. Your old way still exists. Approximately all real world users demonstrably prefer the new way, but if you're set on your old way you can still write software for macOS and Windows. It will pop a warning, but you can make it run anyway. Give your users instructions for bypassing those warnings. If you trust them to manually verify your software then you trust them to follow those directions.
    - Wowfunhappy 8y ago
      > Give your users instructions for bypassing those warnings. If you trust them to manually verify your software then you trust them to follow those directions. If your selling software, this probably isn't a good strategy. However, I consider it perfectly reasonable for software that's being created in one's spare time and offered for free. (I think the current situation we have on Windows / macOS is a perfectly fine balance, btw—except for drivers, where installing unsigned copies is way too difficult)
- izacus 8y ago
  The existence of whole industrial and home computer industry kinda proves that the models were effective and worked. Yes, there were vulnerabilities and viruses but that did not stop the computer industry from growing and proving its worth.
  - adrianratnapala 8y ago
    This is true, but "worked" does mean it was secure by whatever we standard we consider good today. That might be because we (at least on sites like this) are being overzealous about security. Or it might mean that in the modern environment, security is more of the concerns than in the halcyon days of MS-DOS.
- hota_mazi 8y ago
  Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.
  - meditate 8y ago
    It doesn't make it inherently safe, but if you are attempting to prove your builds are safe then it is impossible for anyone else to verify that without the source. See the thread on Debian reproducible builds from earlier this week for more discussion on this topic: https://news.ycombinator.com/item?id=19310638 https://news.ycombinator.com/item?id=19310638 Code signing is something you can do on both open-source or closed-source, but it doesn't prove anything other than that a particular build was made by a certain person.
    - Spivak 8y ago
      "but it doesn't prove anything other than that a particular build was made by a certain person." But that's what trust actually is. This IRL person or identity, that I trust, vouches for the non-maliciousness of this application.
      - Nasrudith 8y ago
        Except the core problem is key propagation because just anyone can have a key - paid or free if you don't know the source. It says it is from Globe Software and it matches with the provided key. It doesn't tell you if they really are Globe Software, let alone if they are a trustworthy company in the first place.
  - 0815test 8y ago
    If your compiler correctly enforces security properties (and many languages do attempt to do this, at least in well-defined "safe" subsets), then of course any source code compiled with it is going to be safe. It's the difference between the JavaScript/WASM JIT-powered sandbox on the one hand, and the ActiveX code-signing-based model on the other. Which is safer?
- throwawaymath 8y ago
  > absurd advice that security experts put out about "only download something you trust" This is mostly a meme from the overzealous FOSS and privacy crowd, not the security crowd. Professional security engineers do not, as a rule, encourage software engineers (or end users more generally) to only use open source software because "you can inspect the code for vulnerabilities." Anyone with legitimate security expertise will understand the benefits of specialization and core competencies. Namely that despite the ideological perspective of many in the FOSS community, it is actually better to trust someone else with the security of your software. Because you most likely can't trust yourself with that task anyway. The idea that most people can reliably identify security vulnerabilities in the software they use just because it's open source is laughable. They might find trivial low hanging fruit or obvious malicious activity, but they won't have a better picture of the overall security posture just because they can read the code. As an obvious case in point, consider how few people identify vulnerabilities in Firefox versus how many people use Firefox. The people who write complex open source software don't even reliably find the issues in their own code.
  - duxup 8y ago
    Yeah I didn't intend to tie FOSS advice to the security comment but inadvertently my comment reads like that. I intended it to just be a comparison of the "only download something you trust" absurd advice you get from "security" people you see on TV or something... and what the user was suggesting about the old days. My FOSS comment was really meant to reflect the absolute rabbit hole you go down when it is suggested people can simply protect themselves. It's never ending flow of tasks and things you need to know that I don't think anyone can do ...
  - Faark 8y ago
    > Professional security engineers do not, as a rule, encourage software engineers [..] to only use open source software because "you can inspect the code for vulnerabilities." All else being equal, I'd certainly have more trust in the FOSS version. Yes, i won't audit it myself, but source we can compile ourself is still easier to audit. As such I'd hope more people will have eyes on it than without source access. Same for a hash of the executable I download being generated by an reproducible build. And I prefer to download and run the same installer as everyone else than someone offering a custom download link just for me. Non of that means I don't have to trust the project/maintainer. But it is a bit of extra safety I want in some cases, e.g. for a password manager.
- balabaster 8y ago
  Back in the day, you used to evaluate trust by making smarter decisions about how you went about installing things. You downloaded it to an isolated environment and ran it and proved it didn't cause unexpected side effects. It was run behind a firewall that could log internet communication. If it proved to be good, you ran it in your main environment. If it proved to be bad you warned everyone who would listen to you. I feel like the more "social" the web appears to be becoming, the less social it actually is. We had tight little BBS and IRC communities where this stuff was all discussed. Social meant we actually had meaningful conversations... okay, not always meaningful, but it was often about the pursuit of something useful. It's nigh on impossible with the proliferation of the internet to take this approach these days. Things just didn't scale that well. This is why things like DD-WRT and other hacker sites while being more accessible are still very much a niche market. It's funny how much more technical you had to be back then just to get online. It's as if we're driving the automatic version of the internet now. Back then we had cobble all the pieces together and even when you had, it was like driving with a manual gearshift.
  - Someone 8y ago
    ”and proved it didn't cause unexpected side effects.” and convinced yourself it didn't cause unexpected side effects. Put a one month timer in your malware, and this would get past many of such attempts to ‘prove’ the software isn’t evil. Add a few countermeasures against clock shifts (e.g. only be active a few minutes each month or only activate when a) enough time and b) enough user interactions have passed from the first run), and you’ll effectively get past most, if not all, of such black-box testing exercises.
    - balabaster 8y ago
      > and convinced yourself it didn't cause unexpected side effects. To be fair, with virus proliferation in today's age, we were still more successful with the remedial precautions back then than seems to be the case today.
- kazinator 8y ago
  The problem is that the software itself is not trustworthy, even if signed, certified and delivered with perfect integrity. Any scum can pay money to get a certificate; you don't have to pass an ethics examination. It is just a racket.
- diminoten 8y ago
  > Is there any evidence that was ever really a thing / effective? Of course not, the person who wrote that has absolutely no concept of the modern Internet user, and probably thinks themselves materially better than them.
- iamaelephant 8y ago
  > Is there any evidence that was ever really a thing Are you asking if software existed before code signing? Yes, it did.
  - randyrand 8y ago
    HN has a guideline that you should respond to the best interpretation of a comment, not the least favorable one. IMO he was clearly reffering to 'thing' being 'an effective thing' for preventing viruses, as opposed to him asking if people downloaded software before code signing.
scarface74 8y ago
When were those days that people disassembled every executable and went through the assembly to make sure that the code was trustworthy? I’ve been using personal computers for over 30 years and I don’t remember those days.
Waterluvian 8y ago
"The good old days" are quite often just the ignorant old days where it was much harder to be made aware that the way you experience the world isn't how everyone else does.
roywiggins 8y ago
which days? when people were cheerfully downloading and running keygen executables to crack their Photoshop trials?
close04 8y ago
> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. With attacks getting more and more sophisticated just downloading from the legitimate site no longer guarantees integrity. Sometimes not even having the exe signed does it, with supply chain attacks and code injected long before being signed. Perhaps also posting the hash on a public website (a tweet for example) 24h before making the installer available would mitigate the code signing issue. You could use it as an authoritative source that's less likely to be breached/modified after posting without immediately raising flags. And if it was an unauthorized post the 24h also gives the author enough time to flag it. Supply chain attacks are not considered here.
- k32sic 8y ago
  I will always put more trust to downloads form web sites that have an owner, than apps coming from an app store. It is very easy to put my trust in an app when I see the amount of work has been put in setting up a site (documentation, history of development, etc). The app stores do not offer any kind of information that would help to put my trust in the developer and application. Certifactes are a fallacy that tell nothing about the security of the app. They just tell that the app was signed someone that has a security certificate. Also why do all security experts want to shove their security agenda to the world ? If you are dealing with life or death matter than it is probably better not to expose your world to the wild. For everything else it is OK to live without the safety net, it is OK if someone looses some money or your mum's disk gets encrypted. People fall every day and I sencerly hope that there will not be some police that will force you to wear a helmet ass soon as you get out of the bed.
  - close04 8y ago
    > I will always put more trust to downloads form web sites that have an owner, than apps coming from an app store. The article is about signing the Windows binary that you download from the developer's site so when the UAC dialog pops up on installation it shows a valid publisher. Nothing to do with an app store. > The app stores Again, different topic. > Certifactes are a fallacy that tell nothing about the security of the app. Actually they do. It's a 0 effort way for the user to tell that the installer was not modified between compilation and installation. How do you tell that the developer's site wasn't hacked and the installer doesn't have some bundled malware? > Also why do all security experts want to shove their security agenda to the world ? Because that 1 million computer botnet attacking your site may just be made up of a lot of people who don't know what certificates are for, how to check if a download is legit, etc.
EpicEng 8y ago
"the good old days", as in, "the days when the average person had no freaking clue if something was safe, but installed it anyway because it's completely unreasonable to expect them to do otherwise"? If your security model is "do your research" then you're going to fail.
- sodosopa 8y ago
  Reminds me of the saying, “I would RTFM if there was a FM to R”
- AnIdiotOnTheNet 8y ago
  Just because someone certifies that it wasn't tampered with and comes from who it says it does doesn't mean it is safe.
  - fjabre 8y ago
    A novel idea. Apple and googles own apps have been tampered with. Indeed there are compromised apps available for download now on both stores. Perhaps it's 'safer' but now we all ask permission and pay a huge tax to release software. Is this a better system? The web is alive but under attack. What freedoms will devs have left? We will either pay comcast or we will pay google and apple. Either way the entrance fee for development just became a lot higher.
  - EpicEng 8y ago
    Perfection isn't required. None of the systems we design are perfect. What's relevant is whether or not it's better for the users. In a direct way, for the average user, I don't think you can reasonably argue that it's not. There are of course other issues with walled gardens, but security isn't one of them.
sephoric 8y ago
The days of custom software are over in general. Every major niche has at least one major player that offers its services for free, selling your data (or ads, etc) in exchange. I'm not sure Sublime Text gets any money anymore now that VS Code does all the same things and more. Custom music players have been dead since Winamp 3. The 1990s and 2000s were like the Wild West for software, now it's like California, fully settled and complete with monopolies.
- fjabre 8y ago
  This is the problem as youve highlighted. We must now contend with these power brokers and ask their permission for every install.
1wd 8y ago
Also code signing doesn't automatically lead to the "blue-trusted UAC popup" anymore anyway.
- gruez 8y ago
  You're conflating the UAC prompt with the smartscreen popup. see: https://news.ycombinator.com/item?id=19330901 https://news.ycombinator.com/item?id=19330901
armandososa 8y ago
Ah the good old days when nobody except the experts cared to buy, never mind install, third party software.
- fjabre 8y ago
  We made it work and didnt have to ask IBMs permission to install software on its devices.
  - armandososa 8y ago
    yes, but that "we" was a very small number of people. Pretty much the same number of people who could do it today.
sigi45 8y ago
Are you kidding me? Have you never done family support the last 15 years?...
godzillabrennus 8y ago
When were those days? I remember that 99/100 users didn’t think before installing a free screensaver and got hit with some kind of malware. While I disagree with how centralized this practice is I’m applauding that an effort is being made to keep malware off consumer devices. What we need is a decentralized and self policing ecosystem. A Wikipedia of validation. Something that’s truly monumenta to pull together. I understand why so many vendors have centralized their efforts.
- fjabre 8y ago
  Centralized their efforts at our expense. They work for their shareholders.
  - godzillabrennus 8y ago
    Buy shares. Become a shareholder. These are public entities.
vkou 8y ago
> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. The Linux kernel, as of today, has ~20 million lines of code, and hundreds of vulnerabilities. Since I presume that you are a user of Linux - what kind of research do you, personally do, to identify, and protect yourself from the potential dangers of running your operating system? Have you read through all of those 20 million LOC, and understood them in context? Do you compile your kernel from scratch? Do you completely, and fully understand the machine code that your C compiler will transform them into?
vb6lives 8y ago
Those days never existed. Which is why certs, app stores, and walled gardens exist.
- fjabre 8y ago
  Pretty soon thats all that will exist.
Tsubasachan 8y ago
Problem is that people suck. They don't blame themselves for doing something stupid. They blame Microsoft. Personal responsibility? Ha!
JohnFen 8y ago
> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe This. The sad thing is that this is still as important to do as it ever was -- but fewer people do it.

by fjabre 8y ago

UncleMeat 8y ago

I am absolutely confident that the overwhelming majority of people have never evaluated the safety of an exe in their life and could not tell you how to do it even if they wanted to. Things that work for security-aware software engineers don't work for billions of people.

deleted 8y ago
[deleted]

duxup 8y ago

>I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. Is there any evidence that was ever really a thing / effective? How could you possibly know? There are plenty of examples of previously trustworthy software becoming untrustworthy, same with sites you download the code from. That line reads like the absurd advice that security experts put out about "only download something you trust" and ignoring that nobody has a clue how to evaluate that aside form say limiting them self to FOSS and reading all the code...

zrobotics 8y ago
>>FOSS and reading all the code... Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.
- lghh 8y ago
  And also trust yourself to have a better idea than the devs do about security. Most flaws are accidents and accidents can be hard to catch.
- fjabre 8y ago
  Every good dev knows to stay the hell away from sourceforge!
  - throwawaymath 8y ago
    Only if that's part of your definition of a good dev. I know plenty of good devs who downloaded software from Sourceforge back when it was big. Let me guess: you also dislike GitHub because it's closed, and wish people would distribute software from their own, self-hosted git repositories?
    - thanksDr 8y ago
      Devs get better by learning from mistakes. Sourceforge is a hostile source of malware : https://mail.gnome.org/archives/gimp-developer-list/2015-May/msg00144.html https://mail.gnome.org/archives/gimp-developer-list/2015-May... You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast.
      - detaro 8y ago
        was, not is. Sourceforge has changed hands since then.
        duxup 8y ago
        Yeah my understanding is after it changed hands they did away with all the nasty stuff that happened in the past.
      - throwawaymath 8y ago
        > You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast. Oh no, it's the 90s and Micro$oft is evil! They're going to embrace, extend, extinguish all my open source software! I won't be free to develop software anymore! I'm quite happy with Microsoft, and if supporting GitHub "feeds the beast", then I'm likewise happy to see that beast well-fed.
fjabre 8y ago
Of course but all of the above mentioned can still happen and does happen today with all security measures in place. With the added benefit that we must ask permission of a private entity to release an app and we must pay 30% of our profits to the gatekeepers /s I think I like the old way better.
- duxup 8y ago
  I don't think I understand what the difference is with the "old way" if as you describe it ... there seems to be no difference. You don't have to pay some cert provider under the old or current way.
  - fjabre 8y ago
    You do if you want your app not to be flagged as spam. Users are perceptive. They notice when windows brings up a big notice telling them the app is not to be trusted. Perception is everything in those first few moments a user get his hands on your software. But now if I dont pay the entrance fee I potentially get abandoned by said user bc they have been scared off. Its not an app store yet. Give it 5 or 10 years when we no longer have an open web and all we have are walled gardens.
- throwawaymath 8y ago
  You don't have to do anything you don't want to. No one is forcing you to develop for those platforms. Your old way still exists. Approximately all real world users demonstrably prefer the new way, but if you're set on your old way you can still write software for macOS and Windows. It will pop a warning, but you can make it run anyway. Give your users instructions for bypassing those warnings. If you trust them to manually verify your software then you trust them to follow those directions.
  - Wowfunhappy 8y ago
    > Give your users instructions for bypassing those warnings. If you trust them to manually verify your software then you trust them to follow those directions. If your selling software, this probably isn't a good strategy. However, I consider it perfectly reasonable for software that's being created in one's spare time and offered for free. (I think the current situation we have on Windows / macOS is a perfectly fine balance, btw—except for drivers, where installing unsigned copies is way too difficult)
izacus 8y ago
The existence of whole industrial and home computer industry kinda proves that the models were effective and worked. Yes, there were vulnerabilities and viruses but that did not stop the computer industry from growing and proving its worth.
- adrianratnapala 8y ago
  This is true, but "worked" does mean it was secure by whatever we standard we consider good today. That might be because we (at least on sites like this) are being overzealous about security. Or it might mean that in the modern environment, security is more of the concerns than in the halcyon days of MS-DOS.
hota_mazi 8y ago
Right on. The security paranoid experts and FOSS zealots have always thought for some inexplicable reasons that if you can download a source and build the program yourself, then it's safe.
- meditate 8y ago
  It doesn't make it inherently safe, but if you are attempting to prove your builds are safe then it is impossible for anyone else to verify that without the source. See the thread on Debian reproducible builds from earlier this week for more discussion on this topic: https://news.ycombinator.com/item?id=19310638 https://news.ycombinator.com/item?id=19310638 Code signing is something you can do on both open-source or closed-source, but it doesn't prove anything other than that a particular build was made by a certain person.
  - Spivak 8y ago
    "but it doesn't prove anything other than that a particular build was made by a certain person." But that's what trust actually is. This IRL person or identity, that I trust, vouches for the non-maliciousness of this application.
    - Nasrudith 8y ago
      Except the core problem is key propagation because just anyone can have a key - paid or free if you don't know the source. It says it is from Globe Software and it matches with the provided key. It doesn't tell you if they really are Globe Software, let alone if they are a trustworthy company in the first place.
- 0815test 8y ago
  If your compiler correctly enforces security properties (and many languages do attempt to do this, at least in well-defined "safe" subsets), then of course any source code compiled with it is going to be safe. It's the difference between the JavaScript/WASM JIT-powered sandbox on the one hand, and the ActiveX code-signing-based model on the other. Which is safer?
throwawaymath 8y ago
> absurd advice that security experts put out about "only download something you trust" This is mostly a meme from the overzealous FOSS and privacy crowd, not the security crowd. Professional security engineers do not, as a rule, encourage software engineers (or end users more generally) to only use open source software because "you can inspect the code for vulnerabilities." Anyone with legitimate security expertise will understand the benefits of specialization and core competencies. Namely that despite the ideological perspective of many in the FOSS community, it is actually better to trust someone else with the security of your software. Because you most likely can't trust yourself with that task anyway. The idea that most people can reliably identify security vulnerabilities in the software they use just because it's open source is laughable. They might find trivial low hanging fruit or obvious malicious activity, but they won't have a better picture of the overall security posture just because they can read the code. As an obvious case in point, consider how few people identify vulnerabilities in Firefox versus how many people use Firefox. The people who write complex open source software don't even reliably find the issues in their own code.
- duxup 8y ago
  Yeah I didn't intend to tie FOSS advice to the security comment but inadvertently my comment reads like that. I intended it to just be a comparison of the "only download something you trust" absurd advice you get from "security" people you see on TV or something... and what the user was suggesting about the old days. My FOSS comment was really meant to reflect the absolute rabbit hole you go down when it is suggested people can simply protect themselves. It's never ending flow of tasks and things you need to know that I don't think anyone can do ...
- Faark 8y ago
  > Professional security engineers do not, as a rule, encourage software engineers [..] to only use open source software because "you can inspect the code for vulnerabilities." All else being equal, I'd certainly have more trust in the FOSS version. Yes, i won't audit it myself, but source we can compile ourself is still easier to audit. As such I'd hope more people will have eyes on it than without source access. Same for a hash of the executable I download being generated by an reproducible build. And I prefer to download and run the same installer as everyone else than someone offering a custom download link just for me. Non of that means I don't have to trust the project/maintainer. But it is a bit of extra safety I want in some cases, e.g. for a password manager.
balabaster 8y ago
Back in the day, you used to evaluate trust by making smarter decisions about how you went about installing things. You downloaded it to an isolated environment and ran it and proved it didn't cause unexpected side effects. It was run behind a firewall that could log internet communication. If it proved to be good, you ran it in your main environment. If it proved to be bad you warned everyone who would listen to you. I feel like the more "social" the web appears to be becoming, the less social it actually is. We had tight little BBS and IRC communities where this stuff was all discussed. Social meant we actually had meaningful conversations... okay, not always meaningful, but it was often about the pursuit of something useful. It's nigh on impossible with the proliferation of the internet to take this approach these days. Things just didn't scale that well. This is why things like DD-WRT and other hacker sites while being more accessible are still very much a niche market. It's funny how much more technical you had to be back then just to get online. It's as if we're driving the automatic version of the internet now. Back then we had cobble all the pieces together and even when you had, it was like driving with a manual gearshift.
- Someone 8y ago
  ”and proved it didn't cause unexpected side effects.” and convinced yourself it didn't cause unexpected side effects. Put a one month timer in your malware, and this would get past many of such attempts to ‘prove’ the software isn’t evil. Add a few countermeasures against clock shifts (e.g. only be active a few minutes each month or only activate when a) enough time and b) enough user interactions have passed from the first run), and you’ll effectively get past most, if not all, of such black-box testing exercises.
  - balabaster 8y ago
    > and convinced yourself it didn't cause unexpected side effects. To be fair, with virus proliferation in today's age, we were still more successful with the remedial precautions back then than seems to be the case today.
kazinator 8y ago
The problem is that the software itself is not trustworthy, even if signed, certified and delivered with perfect integrity. Any scum can pay money to get a certificate; you don't have to pass an ethics examination. It is just a racket.
diminoten 8y ago
> Is there any evidence that was ever really a thing / effective? Of course not, the person who wrote that has absolutely no concept of the modern Internet user, and probably thinks themselves materially better than them.
iamaelephant 8y ago
> Is there any evidence that was ever really a thing Are you asking if software existed before code signing? Yes, it did.
- randyrand 8y ago
  HN has a guideline that you should respond to the best interpretation of a comment, not the least favorable one. IMO he was clearly reffering to 'thing' being 'an effective thing' for preventing viruses, as opposed to him asking if people downloaded software before code signing.

scarface74 8y ago

When were those days that people disassembled every executable and went through the assembly to make sure that the code was trustworthy? I’ve been using personal computers for over 30 years and I don’t remember those days.

Waterluvian 8y ago

"The good old days" are quite often just the ignorant old days where it was much harder to be made aware that the way you experience the world isn't how everyone else does.

roywiggins 8y ago

which days? when people were cheerfully downloading and running keygen executables to crack their Photoshop trials?

close04 8y ago

> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. With attacks getting more and more sophisticated just downloading from the legitimate site no longer guarantees integrity. Sometimes not even having the exe signed does it, with supply chain attacks and code injected long before being signed. Perhaps also posting the hash on a public website (a tweet for example) 24h before making the installer available would mitigate the code signing issue. You could use it as an authoritative source that's less likely to be breached/modified after posting without immediately raising flags. And if it was an unauthorized post the 24h also gives the author enough time to flag it. Supply chain attacks are not considered here.

k32sic 8y ago
I will always put more trust to downloads form web sites that have an owner, than apps coming from an app store. It is very easy to put my trust in an app when I see the amount of work has been put in setting up a site (documentation, history of development, etc). The app stores do not offer any kind of information that would help to put my trust in the developer and application. Certifactes are a fallacy that tell nothing about the security of the app. They just tell that the app was signed someone that has a security certificate. Also why do all security experts want to shove their security agenda to the world ? If you are dealing with life or death matter than it is probably better not to expose your world to the wild. For everything else it is OK to live without the safety net, it is OK if someone looses some money or your mum's disk gets encrypted. People fall every day and I sencerly hope that there will not be some police that will force you to wear a helmet ass soon as you get out of the bed.
- close04 8y ago
  > I will always put more trust to downloads form web sites that have an owner, than apps coming from an app store. The article is about signing the Windows binary that you download from the developer's site so when the UAC dialog pops up on installation it shows a valid publisher. Nothing to do with an app store. > The app stores Again, different topic. > Certifactes are a fallacy that tell nothing about the security of the app. Actually they do. It's a 0 effort way for the user to tell that the installer was not modified between compilation and installation. How do you tell that the developer's site wasn't hacked and the installer doesn't have some bundled malware? > Also why do all security experts want to shove their security agenda to the world ? Because that 1 million computer botnet attacking your site may just be made up of a lot of people who don't know what certificates are for, how to check if a download is legit, etc.

EpicEng 8y ago

"the good old days", as in, "the days when the average person had no freaking clue if something was safe, but installed it anyway because it's completely unreasonable to expect them to do otherwise"? If your security model is "do your research" then you're going to fail.

sodosopa 8y ago
Reminds me of the saying, “I would RTFM if there was a FM to R”
AnIdiotOnTheNet 8y ago
Just because someone certifies that it wasn't tampered with and comes from who it says it does doesn't mean it is safe.
- fjabre 8y ago
  A novel idea. Apple and googles own apps have been tampered with. Indeed there are compromised apps available for download now on both stores. Perhaps it's 'safer' but now we all ask permission and pay a huge tax to release software. Is this a better system? The web is alive but under attack. What freedoms will devs have left? We will either pay comcast or we will pay google and apple. Either way the entrance fee for development just became a lot higher.
- EpicEng 8y ago
  Perfection isn't required. None of the systems we design are perfect. What's relevant is whether or not it's better for the users. In a direct way, for the average user, I don't think you can reasonably argue that it's not. There are of course other issues with walled gardens, but security isn't one of them.

sephoric 8y ago

The days of custom software are over in general. Every major niche has at least one major player that offers its services for free, selling your data (or ads, etc) in exchange. I'm not sure Sublime Text gets any money anymore now that VS Code does all the same things and more. Custom music players have been dead since Winamp 3. The 1990s and 2000s were like the Wild West for software, now it's like California, fully settled and complete with monopolies.

fjabre 8y ago
This is the problem as youve highlighted. We must now contend with these power brokers and ask their permission for every install.

1wd 8y ago

Also code signing doesn't automatically lead to the "blue-trusted UAC popup" anymore anyway.

gruez 8y ago
You're conflating the UAC prompt with the smartscreen popup. see: https://news.ycombinator.com/item?id=19330901 https://news.ycombinator.com/item?id=19330901

armandososa 8y ago

Ah the good old days when nobody except the experts cared to buy, never mind install, third party software.

fjabre 8y ago
We made it work and didnt have to ask IBMs permission to install software on its devices.
- armandososa 8y ago
  yes, but that "we" was a very small number of people. Pretty much the same number of people who could do it today.

sigi45 8y ago

Are you kidding me? Have you never done family support the last 15 years?...

godzillabrennus 8y ago

When were those days? I remember that 99/100 users didn’t think before installing a free screensaver and got hit with some kind of malware. While I disagree with how centralized this practice is I’m applauding that an effort is being made to keep malware off consumer devices. What we need is a decentralized and self policing ecosystem. A Wikipedia of validation. Something that’s truly monumenta to pull together. I understand why so many vendors have centralized their efforts.

fjabre 8y ago
Centralized their efforts at our expense. They work for their shareholders.
- godzillabrennus 8y ago
  Buy shares. Become a shareholder. These are public entities.

vkou 8y ago

> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe. The Linux kernel, as of today, has ~20 million lines of code, and hundreds of vulnerabilities. Since I presume that you are a user of Linux - what kind of research do you, personally do, to identify, and protect yourself from the potential dangers of running your operating system? Have you read through all of those 20 million LOC, and understood them in context? Do you compile your kernel from scratch? Do you completely, and fully understand the machine code that your C compiler will transform them into?

vb6lives 8y ago

Those days never existed. Which is why certs, app stores, and walled gardens exist.

fjabre 8y ago
Pretty soon thats all that will exist.

Tsubasachan 8y ago

Problem is that people suck. They don't blame themselves for doing something stupid. They blame Microsoft. Personal responsibility? Ha!

JohnFen 8y ago

> I remember the good old days when people were actually trusted to do their own research before downloading a potentially dangerous exe This. The sad thing is that this is still as important to do as it ever was -- but fewer people do it.