3 ms·

> Until widespread code-signing exists on the web this seems incredibly reckless to expose. [...] HTTPS is basically useless for authenticating dangerous co

> Until widespread code-signing exists on the web this seems incredibly reckless to expose. [...] HTTPS is basically useless for authenticating dangerous code: There are thousands of https domains out there that you can easily put your own code onto, and many of them have EV/DV certificates with reputable names like GitHub attached to them so there won't be any obvious red flags other than the text of the domain name How would code-signing be any better than HTTPS-certificates? That sounds like just another instance you would have to pay fees to.

skybrian 6y ago
You can sign the code on your own computer (which might even be offline) before deploying on some other company's server. So, it's harder for an attacker to get their code signed using your certificate. Hacking into the website would be useless; they'd have to get the code into the development environment. Or to put it another way, an HTTPS server automatically signs any file that it serves. That's too easy.
- kevingadd 6y ago
  "an HTTPS server automatically signs any file that it serves" is a perfect way to put it. When it comes to getting access to code signing certificates, in many cases the state of the art is to have the signing certificate escrowed so aggressively that the only way to sign a binary is for it to go through a full build pipeline, because the central build servers are the only thing with access to the certificate. That significantly reduces the risk of someone managing to get your signing certificate and sign malware, which means you can focus on other vulnerabilities in your pipeline like your revision control server or your library dependencies.
- modeless 6y ago
  You could achieve this with HTTPS and Signed Exchanges. https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc...
  - kevingadd 6y ago
    My understanding is Signed Exchanges only solve "I want to allow another server to handle requests for my HTTPS server" and not "I want to guarantee the integrity of content coming from my HTTPS server". Did they expand the spec to somehow address the latter?
    - modeless 6y ago
      You could obtain an HTTPS certificate and then only use it for offline signing. That would fulfill the same purpose.
      - fabrice_d 6y ago
        But the platform would not know that this is a code signing certificate - unless something specific is designed.
        modeless 6y ago
        HTTPS certificates are already treated as a kind of code signing certificate by browsers.

skybrian 6y ago

You can sign the code on your own computer (which might even be offline) before deploying on some other company's server. So, it's harder for an attacker to get their code signed using your certificate. Hacking into the website would be useless; they'd have to get the code into the development environment. Or to put it another way, an HTTPS server automatically signs any file that it serves. That's too easy.

kevingadd 6y ago
"an HTTPS server automatically signs any file that it serves" is a perfect way to put it. When it comes to getting access to code signing certificates, in many cases the state of the art is to have the signing certificate escrowed so aggressively that the only way to sign a binary is for it to go through a full build pipeline, because the central build servers are the only thing with access to the certificate. That significantly reduces the risk of someone managing to get your signing certificate and sign malware, which means you can focus on other vulnerabilities in your pipeline like your revision control server or your library dependencies.
modeless 6y ago
You could achieve this with HTTPS and Signed Exchanges. https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc...
- kevingadd 6y ago
  My understanding is Signed Exchanges only solve "I want to allow another server to handle requests for my HTTPS server" and not "I want to guarantee the integrity of content coming from my HTTPS server". Did they expand the spec to somehow address the latter?
  - modeless 6y ago
    You could obtain an HTTPS certificate and then only use it for offline signing. That would fulfill the same purpose.
    - fabrice_d 6y ago
      But the platform would not know that this is a code signing certificate - unless something specific is designed.
      - modeless 6y ago
        HTTPS certificates are already treated as a kind of code signing certificate by browsers.