4 ms·

Code signing as a tech and as an idea is perfectly fine. It is a solution to a massive problem with average, technically unsophisticated users downloading and

Code signing as a tech and as an idea is perfectly fine. It is a solution to a massive problem with average, technically unsophisticated users downloading and running all sort of junk without thinking twice, including things that impersonate legit software and generally do shady stuff like dropping random kernel modules. The business scaffolding around it is just wrong, I agree with that. It should be handled by non-profits or state-run organizations. You register a company, you get a signing key. Validation and authentication should be done at source, not across an ocean by a 3rd party outsourced support calling a phone number published in 4th party business directory. This is as ass-backwards as it gets.

crankylinuxuser 7y ago
> Code signing as a tech and as an idea is perfectly fine. It's a scam. Full stop. A standard cert is now free. $0. Nada. Zilch. So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. What does EV do? Oh yeah "You paid $X hundred so you MUST be legit". Sure, they might look at the state's business registry and match the business name in the EV. That's automatable work. But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different.
- gruez 7y ago
  >So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. > [...] >Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different. You seem to be conflating web certificates (for lack of a better term) with code signing certificates. When it comes web certificates, 3 of the 4 major browser vendors are removing EV indications from their UI[1], so I'm not sure where this "push" is from. On the other hand, for code signing certificates, there is a push from MSFT to get EV certificates, since it automatically gains "smartscreen reputation". [1] https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... >But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Like it or not, when it comes to everyday windows users, code signing has the best ux compared to other forms of validation. Right-click -> properties and it shows who signed it and whether it was tampered with. This is much better than posting a file hash (how do you calculate a hash? what happens if the landing page is compromised?), or GPG (how do you install GPG? how do you build up web of trust? are you going just use whatever key that the download page says to use?)
  - tialaramex 7y ago
    > You seem to be conflating web certificates (for lack of a better term) Two suggested better terms for future reference: Certificates in the Web PKI - in one sense "Web PKI" is a misnomer because this PKI is for all TLS on the public Internet which is a lot more than the web, but in another sense it's accurate because in practice all standards development, public oversight, trust store policy setting, and so on takes place because of the Web and not other TLS applications. PKIX Certificates - by using PKIX, the IETF's dialect of the X.509 standard, certificates actually work and have a clearly defined meaning on IP-based networks. This is a broader idea than the Web PKI, encompassing private IP networks, private CAs issuing for constrained uses, and non-TLS traffic for IP networks. But your thrust was correct, code signing is a quite different application for X.509 certificates than PKIX, and especially than the Web PKI.
- zamadatix 7y ago
  > It's a scam. Full stop. Imagine you said the same thing about web certificates prior to Let's Encrypt, does that mean Let's Encrypt is just a scam? No, web certs have inherent technical value everyone was just getting raked over the coals on pricing. Same thing here, there is no "full stop" as signing certs have value but the companies are charging far more than is reasonable.
  - graphememes 7y ago
    The current scaffolding, let’s not beat each other and point our frustration at the right targets
fierarul 7y ago
> The business scaffolding around it is just wrong, I agree with that. It should be handled by non-profits or state-run organizations. You register a company, you get a signing key. Validation and authentication should be done at source, not across an ocean by a 3rd party outsourced support calling a phone number published in 4th party business directory. This is as ass-backwards as it gets. +1 I would love if my local Chamber of Commerce could give me at a reasonable price the code signing key. It's supremely weird they have to power to create the legal entity but for the little code signing key I need to find somebody in a far away country to do it. I don't expect such a desire for state-run organizations from people in the US, but I'm surprised the whole of EU is fine with the status quo.

crankylinuxuser 7y ago

> Code signing as a tech and as an idea is perfectly fine. It's a scam. Full stop. A standard cert is now free. $0. Nada. Zilch. So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. What does EV do? Oh yeah "You paid $X hundred so you MUST be legit". Sure, they might look at the state's business registry and match the business name in the EV. That's automatable work. But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different.

gruez 7y ago
>So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. > [...] >Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different. You seem to be conflating web certificates (for lack of a better term) with code signing certificates. When it comes web certificates, 3 of the 4 major browser vendors are removing EV indications from their UI[1], so I'm not sure where this "push" is from. On the other hand, for code signing certificates, there is a push from MSFT to get EV certificates, since it automatically gains "smartscreen reputation". [1] https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... >But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Like it or not, when it comes to everyday windows users, code signing has the best ux compared to other forms of validation. Right-click -> properties and it shows who signed it and whether it was tampered with. This is much better than posting a file hash (how do you calculate a hash? what happens if the landing page is compromised?), or GPG (how do you install GPG? how do you build up web of trust? are you going just use whatever key that the download page says to use?)
- tialaramex 7y ago
  > You seem to be conflating web certificates (for lack of a better term) Two suggested better terms for future reference: Certificates in the Web PKI - in one sense "Web PKI" is a misnomer because this PKI is for all TLS on the public Internet which is a lot more than the web, but in another sense it's accurate because in practice all standards development, public oversight, trust store policy setting, and so on takes place because of the Web and not other TLS applications. PKIX Certificates - by using PKIX, the IETF's dialect of the X.509 standard, certificates actually work and have a clearly defined meaning on IP-based networks. This is a broader idea than the Web PKI, encompassing private IP networks, private CAs issuing for constrained uses, and non-TLS traffic for IP networks. But your thrust was correct, code signing is a quite different application for X.509 certificates than PKIX, and especially than the Web PKI.
zamadatix 7y ago
> It's a scam. Full stop. Imagine you said the same thing about web certificates prior to Let's Encrypt, does that mean Let's Encrypt is just a scam? No, web certs have inherent technical value everyone was just getting raked over the coals on pricing. Same thing here, there is no "full stop" as signing certs have value but the companies are charging far more than is reasonable.
- graphememes 7y ago
  The current scaffolding, let’s not beat each other and point our frustration at the right targets

fierarul 7y ago

> The business scaffolding around it is just wrong, I agree with that. It should be handled by non-profits or state-run organizations. You register a company, you get a signing key. Validation and authentication should be done at source, not across an ocean by a 3rd party outsourced support calling a phone number published in 4th party business directory. This is as ass-backwards as it gets. +1 I would love if my local Chamber of Commerce could give me at a reasonable price the code signing key. It's supremely weird they have to power to create the legal entity but for the little code signing key I need to find somebody in a far away country to do it. I don't expect such a desire for state-run organizations from people in the US, but I'm surprised the whole of EU is fine with the status quo.