6 ms·

> Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20

by msla 8y ago

> Funny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Why? If I expect to make four figures on spreading malware/adware, and I can assuage the nerves of people like you by spending two or three figures on a certificate, I'm going to buy the certificate and make it look all nice and pretty and take your money. > Your business name and physical address are injected into the certificate. Basically code-signing certificates make it easier for people to find you and sue you if they truly want to. I suspect that's the whole point. So I have to incorporate in Delaware, make up a fake address, and rent a burner phone for a while. I'm not seeing the downside. https://www.bizfilings.com/toolkit/research-topics/incorporating-your-business/how-to-incorporate-a-business-in-delaware https://www.bizfilings.com/toolkit/research-topics/incorpora... > Delaware does not require director names and addresses to be listed in the Certificate of Incorporation.

xvector 8y ago
I would imagine barrier to entry plays a large role in the sense of comfort here. If you have to incorporate in Delaware and pay $500 and jump through hoops, you’re more likely to turn to a simpler and easier alternative.
- juliusmusseau 8y ago
  Exactly! I trust "you must do some things to obtain this" more than I trust "you don't have to do anything".
smacktoward 8y ago
They didn't say they trust the developer who spends the money absolutely, they said they trust the developer who spends the money more than they trust one who doesn't. Which is fair -- as you note, not every scammer will be scared off by the need to spend some money to pull the scam off; but some will, so the ratio of legitimate developers to illegitimate ones will be higher in markets where there's some cost to entry.
- phoe-krk 8y ago
  > not every scammer will be scared off by the need to spend some money to pull the scam off; but some will The same goes for developers, as you can see in this article.
- msla 8y ago
  > Which is fair -- as you note, not every scammer will be scared off by the need to spend some money to pull the scam off; but some will, so the ratio of legitimate developers to illegitimate ones will be higher in markets where there's some cost to entry. The big scammers, the ones who are the most likely to have an actual business plan for selling my information, aren't. Note that I know Adobe is "trusted" in the relevant sense. Note that I don't think Adobe is trustworthy in any real sense.
- uranusjr 8y ago
  It is not fair. The same cost in money does not translate to the same cost in efforts to earn trust. This is structural discrimination.
  - scott_s 8y ago
    You are not necessarily in disagreement with the poster you responded to. They meant it was fair in the sense that the user is using a fair heuristic to determine how likely they are to be scammed. You're saying it's unfair to the person who made the software, as they are experiencing structural discrimination. Those two points are not mutually exclusive.
- landryraccoon 8y ago
  This is fallacious reasoning. A well intentioned open source developer who does not earn any money out of a labor of love has no incentive to further spend money to sign his app that he’s giving away for free anyway. On the flip side, a malicious actor that expects to earn money through a scam has every incentive to spend some money making the app look legit, especially if there is no risk involved.
  - 8y ago
cwyers 8y ago
I mean, if someone is going to commit a crime, forcing them to leave a paper trail is going to scare at least some of them off. And if I'm installing Adobe Photoshop, and the cert comes from Bob's Software Emporium, Delaware, it raises questions.
- Godel_unicode 8y ago
  Is that actually true? How many people, when installing Photoshop, actually look at who issued the cert?
  - cwyers 8y ago
    In Windows, the name of the publisher in the cert shows up on the UAC prompt whenever the program asks for elevated privileges. That's the point of this whole thread -- the author isn't paying for a cert because he can't make the UAC prompt say Notepad++ instead of his real name (which, he could, and I have no idea why he thinks it's so complicated, but there it is).
    - Godel_unicode 8y ago
      That doesn't have anything to do with the question I asked. See also, TLS exceptions.
rando444 8y ago
The part you're missing is that your delaware company burner phone certificate investments can be invalidated in two seconds by the certificate's trust getting revoked.
- Godel_unicode 8y ago
  The part you're missing is that they won't be in practice. There's malware on virustotal with (still) valid code-signing certs.

by msla 8y ago

xvector 8y ago

I would imagine barrier to entry plays a large role in the sense of comfort here. If you have to incorporate in Delaware and pay $500 and jump through hoops, you’re more likely to turn to a simpler and easier alternative.

juliusmusseau 8y ago
Exactly! I trust "you must do some things to obtain this" more than I trust "you don't have to do anything".

smacktoward 8y ago

They didn't say they trust the developer who spends the money absolutely, they said they trust the developer who spends the money more than they trust one who doesn't. Which is fair -- as you note, not every scammer will be scared off by the need to spend some money to pull the scam off; but some will, so the ratio of legitimate developers to illegitimate ones will be higher in markets where there's some cost to entry.

phoe-krk 8y ago
> not every scammer will be scared off by the need to spend some money to pull the scam off; but some will The same goes for developers, as you can see in this article.
msla 8y ago
> Which is fair -- as you note, not every scammer will be scared off by the need to spend some money to pull the scam off; but some will, so the ratio of legitimate developers to illegitimate ones will be higher in markets where there's some cost to entry. The big scammers, the ones who are the most likely to have an actual business plan for selling my information, aren't. Note that I know Adobe is "trusted" in the relevant sense. Note that I don't think Adobe is trustworthy in any real sense.
uranusjr 8y ago
It is not fair. The same cost in money does not translate to the same cost in efforts to earn trust. This is structural discrimination.
- scott_s 8y ago
  You are not necessarily in disagreement with the poster you responded to. They meant it was fair in the sense that the user is using a fair heuristic to determine how likely they are to be scammed. You're saying it's unfair to the person who made the software, as they are experiencing structural discrimination. Those two points are not mutually exclusive.
landryraccoon 8y ago
This is fallacious reasoning. A well intentioned open source developer who does not earn any money out of a labor of love has no incentive to further spend money to sign his app that he’s giving away for free anyway. On the flip side, a malicious actor that expects to earn money through a scam has every incentive to spend some money making the app look legit, especially if there is no risk involved.
- 8y ago

cwyers 8y ago

I mean, if someone is going to commit a crime, forcing them to leave a paper trail is going to scare at least some of them off. And if I'm installing Adobe Photoshop, and the cert comes from Bob's Software Emporium, Delaware, it raises questions.

Godel_unicode 8y ago
Is that actually true? How many people, when installing Photoshop, actually look at who issued the cert?
- cwyers 8y ago
  In Windows, the name of the publisher in the cert shows up on the UAC prompt whenever the program asks for elevated privileges. That's the point of this whole thread -- the author isn't paying for a cert because he can't make the UAC prompt say Notepad++ instead of his real name (which, he could, and I have no idea why he thinks it's so complicated, but there it is).
  - Godel_unicode 8y ago
    That doesn't have anything to do with the question I asked. See also, TLS exceptions.

rando444 8y ago

The part you're missing is that your delaware company burner phone certificate investments can be invalidated in two seconds by the certificate's trust getting revoked.

Godel_unicode 8y ago
The part you're missing is that they won't be in practice. There's malware on virustotal with (still) valid code-signing certs.