5 ms·

Until DNSSEC DANE TLSA is implemented in OSes, an interim solution that is easy and costs nothing is to publish binary hashes into a GitHub repository. It's no

Until DNSSEC DANE TLSA is implemented in OSes, an interim solution that is easy and costs nothing is to publish binary hashes into a GitHub repository. It's not checked by UAC, but it is free and humans can check the hashes with standard tools if they want formal validation. A code signature is actually little more than third-party validation of a hash of a binary file that can't be easily altered. GitHub is your third-party and a repo contains your binary file hash that can't be easily altered. Other than the "scary" yellow UAC dialog and SmartScreen being temporarily annoying after each version release, problem solved! DNCSEC DANE TLSA is the real solution though to all public CA woes. TLSA lets you run your own private CA publicly and be trusted without root certificate stores.

deleted 7y ago
[deleted]
tptacek 7y ago
You can already run your own private CA. What you can't do is get a government to vouch for you, which is effectively what DNSSEC does; it replaces the CA with a tree rooted in country governments. What discretion the de jure controllers of .COM and .IO have, we don't want them exercising over our code. But, of course, the problem for code signing is that they'll have little discretion at all, and, were operating systems to consider switching to DNSSEC, they might as well just stop doing code signing altogether, since creating a situation where anyone can generate an authority that disables the UAC warning box defeats the whole purpose.
- therealduhne 7y ago
  The current code signing paradigm was already tenuous but this change to DigiCert is going to cause far fewer packages to get signed as fewer devs acquire and renew the now very costly certs. We need working alternatives. You didn't provide any solutions but decided to downvote anyway. Code signing has always been about validating the source of a binary and that it hasn't been modified from what the publisher intended. This is done by relying on a third-party validation mechanism. DNSSEC DANE TLSA meets both of those qualifications. So does GitHub. I'd be fine with either or both as options. Microsoft owns GitHub too, so code signing could be done through that medium. Public CAs in a trusted root store allow for offline validation but let's be realistic - most devices and software are online these days and public CAs aren't particularly worthy of anyone's trust. Domain-pinning a private CA in a trust store via TLSA (or GitHub, whichever) would allow for one-time online validation and then permanent offline validation for any given binary thereby allowing device drivers to still load offline. Microsoft unfortunately still claims that code signing stops malware. Time has effectively proven that to be false as code signing has stopped approximately zero malware infestations. Training personnel to be constantly vigilant through ongoing training modules has proven to be far more effective.

deleted 7y ago

[deleted]

tptacek 7y ago

You can already run your own private CA. What you can't do is get a government to vouch for you, which is effectively what DNSSEC does; it replaces the CA with a tree rooted in country governments. What discretion the de jure controllers of .COM and .IO have, we don't want them exercising over our code. But, of course, the problem for code signing is that they'll have little discretion at all, and, were operating systems to consider switching to DNSSEC, they might as well just stop doing code signing altogether, since creating a situation where anyone can generate an authority that disables the UAC warning box defeats the whole purpose.

therealduhne 7y ago
The current code signing paradigm was already tenuous but this change to DigiCert is going to cause far fewer packages to get signed as fewer devs acquire and renew the now very costly certs. We need working alternatives. You didn't provide any solutions but decided to downvote anyway. Code signing has always been about validating the source of a binary and that it hasn't been modified from what the publisher intended. This is done by relying on a third-party validation mechanism. DNSSEC DANE TLSA meets both of those qualifications. So does GitHub. I'd be fine with either or both as options. Microsoft owns GitHub too, so code signing could be done through that medium. Public CAs in a trusted root store allow for offline validation but let's be realistic - most devices and software are online these days and public CAs aren't particularly worthy of anyone's trust. Domain-pinning a private CA in a trust store via TLSA (or GitHub, whichever) would allow for one-time online validation and then permanent offline validation for any given binary thereby allowing device drivers to still load offline. Microsoft unfortunately still claims that code signing stops malware. Time has effectively proven that to be false as code signing has stopped approximately zero malware infestations. Training personnel to be constantly vigilant through ongoing training modules has proven to be far more effective.