3 ms·
Sadly this is really one more line of defense - perhaps one of the last lines of defense - against the pervasive threat of malware which has massively eroded tr
by nneonneo 7y ago
Sadly this is really one more line of defense - perhaps one of the last lines of defense - against the pervasive threat of malware which has massively eroded trust in downloadable binaries. This has been going on for decades, but the rise of money-making ransomware has given criminals a powerful new profit motive for making and distributing malware every possible way they can.
Let’s take some examples from the post. If a domain is 15 years old and implicitly trusted by this point, then an attacker is just going to compromise an ancient WordPress install to post malware.
If an OSS developer occasionally releases software, attackers might approach them to add a new SDK or monetization opportunity (happened many times to VLC - good thing JBK hasn’t been tempted!), or just straight up attempt to compromise their infrastructure (e.g. download servers, has happened to many pieces of software like Transmission).
If we actually had Let‘s Encrypt for code, attackers would trivially get certs for their stuff. Then end-users would have to decide which certs to trust or not, which would significantly weaken the purpose of code-signing.
Short of just sandboxing all binaries by default, I don’t see a great solution to make binary downloads safe. macOS is already moving very heavily in that direction.
- jsmeaton 7y agoYep, letsencrypt handles peer to peer encryption not authentication which is supposed to be the point of codesigning. Not that codesigning helps that much either - you still get big scary prompts on Windows after signing until you generate enough downloads to gain further trust. It’s all a mess.
- atanasi 7y agoCertificates are precisely for authentication, but the simplest form employed by automatic systems like letsencrypt only tries to verify domain control. It does not bind the certificate to any legal identity, unlike stronger forms of certificates.
- zackees 7y agoOr maybe the vulnerabilities should be handled at the OS level with confirmation of privileged access at the user level. If I download a notepad app and it asks me record then that is something that I can respond with. The OS vulnerabilities being exploited should be fixed. The solution of a white list solution managed by unaccountable tech oligarchs should be laughed at and then resisted at all costs.
- nneonneo 7y agoYes, this is more or less sandboxing. The fact that a freshly downloaded binary has r/w access to all of my files should be considered a vulnerability nowadays. The macOS approach, in which a binary only gets access to files that are explicitly selected through the OS’s file chooser, is a good first step. The downside is that it can get very annoying for the user. An ideal solution for desktop machines still doesn’t quite exist.
- contextfree 7y agoThat is also the UWP approach on Windows (though there are also ways to grant a UWP application broader filesystem access)
- soraminazuki 7y agoBecause the internet is such a scary place, Google should get to decide which software gets to thrive? I'm sorry, but your reasoning doesn't make sense to me at all.