5 ms·

Honestly it doesn’t matter at all if it actually happened, that they could is unacceptable. EDIT: To be clear, it's not the certificate revocation that's bad,

by swiley 6y ago

Honestly it doesn’t matter at all if it actually happened, that they could is unacceptable. EDIT: To be clear, it's not the certificate revocation that's bad, it's that the certificate is required to distribute code and can only be acquired from a single organization.

epistasis 6y ago
I think certificate revocation of signed code is a good, useful feature and something that I want as part of my security infrastructure. I wouldn't want it any other way if I have to use non-open source code that I can't inspect. But the basis of all my core software is going to be open source.
- raxxorrax 6y ago
  This will lead to computing being locked down further with really questionable benefits. In fact open source software can suffer greatly because these certs make deployment cost non-zero. So someone providing binaries of such software has to pay for it to large corps like Apple and Microsoft.
  - epistasis 6y ago
    We've been in this situation for 10 years now. Has the slippery slope caused any sliding yet? The cost issue is separate from the revocation issue, and my point was about certain revocation--it's an absolutely great feature for any code signing situation where you are trusting others to compile code for you and others can't confirm that a certain set of binaries came from a certain set of source files. (Reproducible builds could help, of course!)
    - raxxorrax 6y ago
      Eh, yes, we have much more locked down systems with reduced capabilities. Consoles used it maybe for years and they are notorious for being useless for any third party content. You cannot simply write your own drivers for several devices anymore, so you basically booted a lot of engineers. It infected whole industries. We have locked down agricultural devices where users pay for expensive hacks. It is a complete nightmare actually. For security... sure... actually not even my grandmother would believe it.
      - ashtonkem 6y ago
        Consoles haven’t been open for 30 years, but I can still run unsigned code on my Mac. They’re not a good argument for us actually sliding down a slippery slope. And writing drivers for hardware has often been impossible or effectively so due to poor documentation and/or signing. Do you not remember the era when most WiFi cards didn’t work with Linux, or when graphics cards required closed source binary blobs to even work? I get you don’t like it on principle, so maybe you shouldn’t buy a Mac, but the idea that we’re going down a slippery slope is very much [citation needed]
        raxxorrax 6y ago
        I remember the time and I could just fix the driver in some cases at least. And people did and provided solutions. Windows also introduced software signing for drivers and user software, so yes, prevalence does increase while no benefits are provided. What is the advantage of an nvidia binary blob for Linux if it is signed or not. Was downloading from a trusted source a problem? We had hashes if you really wanted them. With signing you make yourself dependent on the manufacturer of the OS. The console argument was a hint that the application gained traction as a DRM utility, not for user security. Because signing here included properties of the medium the software was deployed on, so you couldn't just copy it to another CD/DVD.
    - swiley 6y ago
      > Has the slippery slope caused any sliding yet? Yes it has, that’s the point of this whole discussion. Desktop apps now need to be signed and I’d be willing to bet you couldn’t find a signed torrent client.
      - planb 6y ago
        Why would you be willing to bet if you just can google that the transmission BitTorrent client is in fact gatekeeper-signed?
        raxxorrax 6y ago
        Great example, they had problems with malware infection...
ashtonkem 6y ago
I actually like code signing. I can still run unsigned code by flipping the right setting, but I don’t have to worry about non-developer family members running something bad.

by swiley 6y ago

epistasis 6y ago

I think certificate revocation of signed code is a good, useful feature and something that I want as part of my security infrastructure. I wouldn't want it any other way if I have to use non-open source code that I can't inspect. But the basis of all my core software is going to be open source.

raxxorrax 6y ago
This will lead to computing being locked down further with really questionable benefits. In fact open source software can suffer greatly because these certs make deployment cost non-zero. So someone providing binaries of such software has to pay for it to large corps like Apple and Microsoft.
- epistasis 6y ago
  We've been in this situation for 10 years now. Has the slippery slope caused any sliding yet? The cost issue is separate from the revocation issue, and my point was about certain revocation--it's an absolutely great feature for any code signing situation where you are trusting others to compile code for you and others can't confirm that a certain set of binaries came from a certain set of source files. (Reproducible builds could help, of course!)
  - raxxorrax 6y ago
    Eh, yes, we have much more locked down systems with reduced capabilities. Consoles used it maybe for years and they are notorious for being useless for any third party content. You cannot simply write your own drivers for several devices anymore, so you basically booted a lot of engineers. It infected whole industries. We have locked down agricultural devices where users pay for expensive hacks. It is a complete nightmare actually. For security... sure... actually not even my grandmother would believe it.
    - ashtonkem 6y ago
      Consoles haven’t been open for 30 years, but I can still run unsigned code on my Mac. They’re not a good argument for us actually sliding down a slippery slope. And writing drivers for hardware has often been impossible or effectively so due to poor documentation and/or signing. Do you not remember the era when most WiFi cards didn’t work with Linux, or when graphics cards required closed source binary blobs to even work? I get you don’t like it on principle, so maybe you shouldn’t buy a Mac, but the idea that we’re going down a slippery slope is very much [citation needed]
      - raxxorrax 6y ago
        I remember the time and I could just fix the driver in some cases at least. And people did and provided solutions. Windows also introduced software signing for drivers and user software, so yes, prevalence does increase while no benefits are provided. What is the advantage of an nvidia binary blob for Linux if it is signed or not. Was downloading from a trusted source a problem? We had hashes if you really wanted them. With signing you make yourself dependent on the manufacturer of the OS. The console argument was a hint that the application gained traction as a DRM utility, not for user security. Because signing here included properties of the medium the software was deployed on, so you couldn't just copy it to another CD/DVD.
  - swiley 6y ago
    > Has the slippery slope caused any sliding yet? Yes it has, that’s the point of this whole discussion. Desktop apps now need to be signed and I’d be willing to bet you couldn’t find a signed torrent client.
    - planb 6y ago
      Why would you be willing to bet if you just can google that the transmission BitTorrent client is in fact gatekeeper-signed?
      - raxxorrax 6y ago
        Great example, they had problems with malware infection...

ashtonkem 6y ago

I actually like code signing. I can still run unsigned code by flipping the right setting, but I don’t have to worry about non-developer family members running something bad.