3 ms·

> Code signing as a tech and as an idea is perfectly fine. It's a scam. Full stop. A standard cert is now free. $0. Nada. Zilch. So what are the power-playe

> Code signing as a tech and as an idea is perfectly fine. It's a scam. Full stop. A standard cert is now free. $0. Nada. Zilch. So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. What does EV do? Oh yeah "You paid $X hundred so you MUST be legit". Sure, they might look at the state's business registry and match the business name in the EV. That's automatable work. But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different.

gruez 7y ago
>So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. > [...] >Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different. You seem to be conflating web certificates (for lack of a better term) with code signing certificates. When it comes web certificates, 3 of the 4 major browser vendors are removing EV indications from their UI[1], so I'm not sure where this "push" is from. On the other hand, for code signing certificates, there is a push from MSFT to get EV certificates, since it automatically gains "smartscreen reputation". [1] https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... >But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Like it or not, when it comes to everyday windows users, code signing has the best ux compared to other forms of validation. Right-click -> properties and it shows who signed it and whether it was tampered with. This is much better than posting a file hash (how do you calculate a hash? what happens if the landing page is compromised?), or GPG (how do you install GPG? how do you build up web of trust? are you going just use whatever key that the download page says to use?)
- tialaramex 7y ago
  > You seem to be conflating web certificates (for lack of a better term) Two suggested better terms for future reference: Certificates in the Web PKI - in one sense "Web PKI" is a misnomer because this PKI is for all TLS on the public Internet which is a lot more than the web, but in another sense it's accurate because in practice all standards development, public oversight, trust store policy setting, and so on takes place because of the Web and not other TLS applications. PKIX Certificates - by using PKIX, the IETF's dialect of the X.509 standard, certificates actually work and have a clearly defined meaning on IP-based networks. This is a broader idea than the Web PKI, encompassing private IP networks, private CAs issuing for constrained uses, and non-TLS traffic for IP networks. But your thrust was correct, code signing is a quite different application for X.509 certificates than PKIX, and especially than the Web PKI.
zamadatix 7y ago
> It's a scam. Full stop. Imagine you said the same thing about web certificates prior to Let's Encrypt, does that mean Let's Encrypt is just a scam? No, web certs have inherent technical value everyone was just getting raked over the coals on pricing. Same thing here, there is no "full stop" as signing certs have value but the companies are charging far more than is reasonable.
- graphememes 7y ago
  The current scaffolding, let’s not beat each other and point our frustration at the right targets

gruez 7y ago

>So what are the power-players doing? They're deprecating the validity of 'those free certs', and pushing EV. > [...] >Cert chains from the root authorities have been a continual scam, until LetsEncrypt showed up. This EV bullshit is no different. You seem to be conflating web certificates (for lack of a better term) with code signing certificates. When it comes web certificates, 3 of the 4 major browser vendors are removing EV indications from their UI[1], so I'm not sure where this "push" is from. On the other hand, for code signing certificates, there is a push from MSFT to get EV certificates, since it automatically gains "smartscreen reputation". [1] https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... >But there you have it, piles of money because 'a real business can afford it'. And some assumption that scammers wont. Like it or not, when it comes to everyday windows users, code signing has the best ux compared to other forms of validation. Right-click -> properties and it shows who signed it and whether it was tampered with. This is much better than posting a file hash (how do you calculate a hash? what happens if the landing page is compromised?), or GPG (how do you install GPG? how do you build up web of trust? are you going just use whatever key that the download page says to use?)

tialaramex 7y ago
> You seem to be conflating web certificates (for lack of a better term) Two suggested better terms for future reference: Certificates in the Web PKI - in one sense "Web PKI" is a misnomer because this PKI is for all TLS on the public Internet which is a lot more than the web, but in another sense it's accurate because in practice all standards development, public oversight, trust store policy setting, and so on takes place because of the Web and not other TLS applications. PKIX Certificates - by using PKIX, the IETF's dialect of the X.509 standard, certificates actually work and have a clearly defined meaning on IP-based networks. This is a broader idea than the Web PKI, encompassing private IP networks, private CAs issuing for constrained uses, and non-TLS traffic for IP networks. But your thrust was correct, code signing is a quite different application for X.509 certificates than PKIX, and especially than the Web PKI.

zamadatix 7y ago

> It's a scam. Full stop. Imagine you said the same thing about web certificates prior to Let's Encrypt, does that mean Let's Encrypt is just a scam? No, web certs have inherent technical value everyone was just getting raked over the coals on pricing. Same thing here, there is no "full stop" as signing certs have value but the companies are charging far more than is reasonable.

graphememes 7y ago
The current scaffolding, let’s not beat each other and point our frustration at the right targets