7 ms·

Code signing is a strong arm tactic and the ones who run the industry are a huge mafia game. Hate every aspect of it.

Boulth 7y ago
That's one way to look at it. On the other hand for consumers it's a vastly more convenient experience than something like this: https://www.sublimemerge.com/docs/linux_repositories https://www.sublimemerge.com/docs/linux_repositories
- stephenr 7y ago
  You realise that page has instructions for two branches (dev/stable) for 5 different package managers? I can't really imagine someone who needs to use a text merge tool, and uses a Linux desktop, but finds it overwhelming to run, at most, 3 commands.
  - Boulth 7y ago
    Compare this with the Windows/MacOS instructions: https://www.sublimemerge.com/download https://www.sublimemerge.com/download Just in case it's not clear: there are none. You just download the file and run it. That's the problem that Microsoft code signing certs solve. Sure, it's not overwhelming, but without thinking about UX 2020 won't be the year of Linux Desktop. "5 different package managers" is part of the problem. The text merge tool is just an example.
    - stephenr 7y ago
      I must have missed the part where a code signing certificate provides you with software versioning, dependency management and updating. I guess you learn something every day. Additional: > "5 different package managers" is part of the problem. Problem for who?
      - Boulth 7y ago
        I never said anything like that about code signing (you may want to check out "in comments" section of the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). Code signing allows software vendors to opt in to a reputation based scheme of authenticating software. There is nothing like that on Linux. There are similar systems within distros (Debian Developers, Arch TU etc.) but each one of them is for that one particular distro. EV Code Signing certs require that the private key is stored on a hardware token (so it's harder to misuse). This is also something that's not utilized by packagers. Code signing doesn't solve world hunger but it doesn't mean it's all evil. > Problem for who? ISVs and ultimately their users.
    - nemetroid 7y ago
      That same page has pre-built Linux packages available for download as well. It's perfectly possible to download and run those packages and get the Windows experience without the racketeering.
      - Boulth 7y ago
        Yes, that's pretty close. Windows one is directly executable (installer) but the MacOS is compressed too.
- ryanlol 7y ago
  You can’t even begin to compare these things. Cryptography is used for both, but these systems have completely different goals.
  - Boulth 7y ago
    Could you elaborate on the "different goals" here? As far as I understand this is about getting software from the vendor to the hands of users.
huhtenberg 7y ago
Code signing as a tech and as an idea is perfectly fine. It is a solution to a massive problem with average, technically unsophisticated users downloading and running all sort of junk without thinking twice, including things that impersonate legit software and generally do shady stuff like dropping random kernel modules. The business scaffolding around it is just wrong, I agree with that. It should be handled by non-profits or state-run organizations. You register a company, you get a signing key. Validation and authentication should be done at source, not across an ocean by a 3rd party outsourced support calling a phone number published in 4th party business directory. This is as ass-backwards as it gets.
- crankylinuxuser 7y ago
  > Code signing as a tech and as an idea is perfectly fine. It's a scam. Full stop. A standard cert is now free. $0. Nada. Zilch. So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. What does EV do? Oh yeah "You paid $X hundred so you MUST be legit". Sure, they might look at the state's business registry and match the business name in the EV. That's automatable work. But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different.
  - gruez 7y ago
    >So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. > [...] >Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different. You seem to be conflating web certificates (for lack of a better term) with code signing certificates. When it comes web certificates, 3 of the 4 major browser vendors are removing EV indications from their UI[1], so I'm not sure where this "push" is from. On the other hand, for code signing certificates, there is a push from MSFT to get EV certificates, since it automatically gains "smartscreen reputation". [1] https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... >But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Like it or not, when it comes to everyday windows users, code signing has the best ux compared to other forms of validation. Right-click -> properties and it shows who signed it and whether it was tampered with. This is much better than posting a file hash (how do you calculate a hash? what happens if the landing page is compromised?), or GPG (how do you install GPG? how do you build up web of trust? are you going just use whatever key that the download page says to use?)
matheusmoreira 7y ago
Code signing is fine. The problem is these companies are the ones who hold the keys.

That's one way to look at it. On the other hand for consumers it's a vastly more convenient experience than something like this: https://www.sublimemerge.com/docs/linux_repositories https://www.sublimemerge.com/docs/linux_repositories

stephenr 7y ago
You realise that page has instructions for two branches (dev/stable) for 5 different package managers? I can't really imagine someone who needs to use a text merge tool, and uses a Linux desktop, but finds it overwhelming to run, at most, 3 commands.
- Boulth 7y ago
  Compare this with the Windows/MacOS instructions: https://www.sublimemerge.com/download https://www.sublimemerge.com/download Just in case it's not clear: there are none. You just download the file and run it. That's the problem that Microsoft code signing certs solve. Sure, it's not overwhelming, but without thinking about UX 2020 won't be the year of Linux Desktop. "5 different package managers" is part of the problem. The text merge tool is just an example.
  - stephenr 7y ago
    I must have missed the part where a code signing certificate provides you with software versioning, dependency management and updating. I guess you learn something every day. Additional: > "5 different package managers" is part of the problem. Problem for who?
    - Boulth 7y ago
      I never said anything like that about code signing (you may want to check out "in comments" section of the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html). Code signing allows software vendors to opt in to a reputation based scheme of authenticating software. There is nothing like that on Linux. There are similar systems within distros (Debian Developers, Arch TU etc.) but each one of them is for that one particular distro. EV Code Signing certs require that the private key is stored on a hardware token (so it's harder to misuse). This is also something that's not utilized by packagers. Code signing doesn't solve world hunger but it doesn't mean it's all evil. > Problem for who? ISVs and ultimately their users.
  - nemetroid 7y ago
    That same page has pre-built Linux packages available for download as well. It's perfectly possible to download and run those packages and get the Windows experience without the racketeering.
    - Boulth 7y ago
      Yes, that's pretty close. Windows one is directly executable (installer) but the MacOS is compressed too.
ryanlol 7y ago
You can’t even begin to compare these things. Cryptography is used for both, but these systems have completely different goals.
- Boulth 7y ago
  Could you elaborate on the "different goals" here? As far as I understand this is about getting software from the vendor to the hands of users.

huhtenberg 7y ago

Code signing as a tech and as an idea is perfectly fine. It is a solution to a massive problem with average, technically unsophisticated users downloading and running all sort of junk without thinking twice, including things that impersonate legit software and generally do shady stuff like dropping random kernel modules. The business scaffolding around it is just wrong, I agree with that. It should be handled by non-profits or state-run organizations. You register a company, you get a signing key. Validation and authentication should be done at source, not across an ocean by a 3rd party outsourced support calling a phone number published in 4th party business directory. This is as ass-backwards as it gets.

crankylinuxuser 7y ago
> Code signing as a tech and as an idea is perfectly fine. It's a scam. Full stop. A standard cert is now free. $0. Nada. Zilch. So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. What does EV do? Oh yeah "You paid $X hundred so you MUST be legit". Sure, they might look at the state's business registry and match the business name in the EV. That's automatable work. But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different.
- gruez 7y ago
  >So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. > [...] >Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different. You seem to be conflating web certificates (for lack of a better term) with code signing certificates. When it comes web certificates, 3 of the 4 major browser vendors are removing EV indications from their UI[1], so I'm not sure where this "push" is from. On the other hand, for code signing certificates, there is a push from MSFT to get EV certificates, since it automatically gains "smartscreen reputation". [1] https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... >But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Like it or not, when it comes to everyday windows users, code signing has the best ux compared to other forms of validation. Right-click -> properties and it shows who signed it and whether it was tampered with. This is much better than posting a file hash (how do you calculate a hash? what happens if the landing page is compromised?), or GPG (how do you install GPG? how do you build up web of trust? are you going just use whatever key that the download page says to use?)

matheusmoreira 7y ago

Code signing is fine. The problem is these companies are the ones who hold the keys.