3 ms·
Application signing is a mafia protection racket, plain and simple. If you aren't signed by an "authority", every user is told by default automatically that yo
by ebg13 6y ago
Application signing is a mafia protection racket, plain and simple.
If you aren't signed by an "authority", every user is told by default automatically that your code is unsafe until you pay money.
It is 100% analogous to thugs walking into your store saying "It would be a real shame if something were to happen to scare people away."
The message is "We Protected You" and "Unsafe". WHY? Because "WE don't recognize" it.
Application signing certificates cost money. Always. And if you're making something for free either out of the goodness of your heart or because you like making things, that money has to come out of your pocket just so the thugs don't stand in front of your door with bats. Nobody should be ok with that. AND FUN FACT: malicious or incompetent actors can and do also pay money.
- alkonaut 6y agoIsn't this exactly how ssl works too, and that also cost around this sum of money up until recently (with LetsEncrypt)?
- lostmsu 6y agoI think a major difference here is that LetsEncrypt relies on an already existing third-party authority, that generally has some scrutiny to it: DNS registrars.
- kevingadd 6y agoNot sure what you mean here, code signing certs are issued by many of the same companies that were issuing SSL certs before LE existed
- gruez 6y agoHis point is that with webtrust certificates (what most people think of as "ssl certificates"), it's easy to validate the identity (DNS name), either by sending a email or validating a DNS record. For code signing certificates, they're not issued to DNS names, they're issued to legal entities (natural persons or corporations), which you can't easily validate.
- Zak 6y agoCode signing certificates could be issued to domain names, and that might provide a lower bar to clear while still offering a good way to establish a reputation.
- donmcronald 6y agoThey should be issued to domain names. I bet there are close to 100 domains I’d recognize from small or open source developers and I couldn’t tell you the name or company name of a single one of them. It’ll never happen though because Microsoft, Google, and Apple are doing everything they can to de-emphasize domains and online namespaces so they can become the gatekeepers of all content.
- novok 6y agoIt was about $10-$20/year although.
- umvi 6y agoFirst they came for the iOS developers, and I did not speak out, because I wasn't an iOS developer. Then they came for the Windows developers, and I did not speak out, because I wasn't a Windows developer... I sure wish I could distribute the software I write without paying some rent-collector (at least) $100 for the privilege.
- danieldk 6y agoThe problem isn't the rent. It may be an inconvenience for an indie developer, but to Microsoft, Apple, etc. the cost of a yearly developer account is peanuts. They are not doing it hoping to make excessive amounts of money. Even if Apple has a million developers paying $100, $100M is barely a blip on their radar. It is all about control. They get to decide whose software gets to run with and whose without annoyances.
- ebg13 6y ago> The problem isn't the rent. Yes and no. I'm making free software for the world, not running a business, and I don't appreciate getting shaken down by a megabillion$ corporation.
- paulryanrogers 6y agoThen why not instead charge a nominal amount like $5? Chrome's extension store does that. My guess is the amount significantly reduces the volume of malware
- Asooka 6y agoYea, I did not speak out. I yelled. But the opposition shouted even louder. Just butting heads doesn't seem to be getting us any results, there are probably better ways to achieve fairness, even if it is not exactly in the form we want (e.g. popup for every program instead of just unsafe ones).