3 ms·

This could be easily achieved by Microsoft running a free signing service. Lowering the cost of signing to zero would significantly increase the proportion of s

This could be easily achieved by Microsoft running a free signing service. Lowering the cost of signing to zero would significantly increase the proportion of signed apps.

pvg 8y ago
The question was 'is someone who spends money for code signing more trustworthy than someone who doesn't' and it was being treated as if the trust or at least, increase in comfort, somehow comes merely from the act of spending money. It's an opt-in to a service that mitigates the impact of malicious code.
- angry_octet 8y ago
  The parent statement was that having signed apps made them easy to disable. If all apps had to be signed, everything would have a reputation hook, and also be easily disabled. It's the hang-up of using the for profit 'verified' code signing ecosystem that makes signing ineffective. Of course, MSFT/Apple etc will abuse it to kill apps they/govt don't like.
  - pvg 8y ago
    I don't really understand how any of this makes signing ineffective.
    - salawat 8y ago
      If the only way to play is to go through entrenched gatekeepers, who watches the watchers, hmmm? If anything this should be seen as a power grab by entrenched interests to have a cryptographic lever to pull to shut people out of what should be a user's discretion decision pre-emptively. Walled gardening at it's finest. Code signing is a bit like gun control. It really doesn't solve the problem at all. It just pushes it up a level, and makes things more difficult for legitimate users. It also lines up incentives such that the preferred model of software distribution shifts in the grand scheme of things toward for profit code. While code signing is a neat technical solution, it's still a technical solution parading about as a solution to a social problem. And the social problem it is a solution to (that of untrustworthy folks existing) is not in any way mitigated by the act of signing as mentioned previously.
      - pvg 8y ago
        I don't really understand how any of this makes signing ineffective.
Tempest1981 8y ago
Apps submitted to the Microsoft Store are signed by Microsoft (only), iirc. Although it costs $19 or $99 to sign up, one time.
- angry_octet 8y ago
  That is partly because only those apps can run on Windows S (also available in 1703: https://www.howtogeek.com/302352/how-to-allow-only-apps-from-the-store-on-windows-10-and-whitelist-desktop-apps/ https://www.howtogeek.com/302352/how-to-allow-only-apps-from...) They could enable this for win32 apps but they want to push things towards the walled garden.

This could be easily achieved by Microsoft running a free signing service. Lowering the cost of signing to zero would significantly increase the proportion of signed apps.

pvg 8y ago

The question was 'is someone who spends money for code signing more trustworthy than someone who doesn't' and it was being treated as if the trust or at least, increase in comfort, somehow comes merely from the act of spending money. It's an opt-in to a service that mitigates the impact of malicious code.

angry_octet 8y ago
The parent statement was that having signed apps made them easy to disable. If all apps had to be signed, everything would have a reputation hook, and also be easily disabled. It's the hang-up of using the for profit 'verified' code signing ecosystem that makes signing ineffective. Of course, MSFT/Apple etc will abuse it to kill apps they/govt don't like.
- pvg 8y ago
  I don't really understand how any of this makes signing ineffective.
  - salawat 8y ago
    If the only way to play is to go through entrenched gatekeepers, who watches the watchers, hmmm? If anything this should be seen as a power grab by entrenched interests to have a cryptographic lever to pull to shut people out of what should be a user's discretion decision pre-emptively. Walled gardening at it's finest. Code signing is a bit like gun control. It really doesn't solve the problem at all. It just pushes it up a level, and makes things more difficult for legitimate users. It also lines up incentives such that the preferred model of software distribution shifts in the grand scheme of things toward for profit code. While code signing is a neat technical solution, it's still a technical solution parading about as a solution to a social problem. And the social problem it is a solution to (that of untrustworthy folks existing) is not in any way mitigated by the act of signing as mentioned previously.
    - pvg 8y ago
      I don't really understand how any of this makes signing ineffective.

Tempest1981 8y ago

Apps submitted to the Microsoft Store are signed by Microsoft (only), iirc. Although it costs $19 or $99 to sign up, one time.

angry_octet 8y ago
That is partly because only those apps can run on Windows S (also available in 1703: https://www.howtogeek.com/302352/how-to-allow-only-apps-from-the-store-on-windows-10-and-whitelist-desktop-apps/ https://www.howtogeek.com/302352/how-to-allow-only-apps-from...) They could enable this for win32 apps but they want to push things towards the walled garden.