17 ms·

First, the releases are signed-- just not with the windows code signing infrastructure. For windows the CA improperly revoked the certificate in response to a

by nullc 6y ago

First, the releases are signed-- just not with the windows code signing infrastructure. For windows the CA improperly revoked the certificate in response to a renewal request and back dated the revocation and are refusing to issue a new certificate (my understanding and that the CA now believes open source collaborations aren't eligible for code signing certs, or some such nonsense... it's being worked out) The releases are still PGP signed by an official project key which has been in use for many years and is cross signed by many parties-- just as they have the last decade--, as well as by another 16 parties that independent reproduced the binaries through the deterministic build process: https://github.com/bitcoin-core/gitian.sigs/tree/master/0.21.1-win-unsigned https://github.com/bitcoin-core/gitian.sigs/tree/master/0.21... which has also been used for the last ten years. Anyone who already has an older faithful copy has the scripts to automatically download and verify the other signatures. By comparison, the windows code signing provides relatively little security assurance. Not too dissimilar from the HTTPS used on the download site. It, like the https, does have the advantage that it is widely checked while many users don't bother checking the actual release signatures. It's useful to have for sure, but it's not the only protection and, unfortunately, it exist only at the whim of a third party that isn't accountable to the users of Bitcoin. But if someone can spoof the download site the executable signing won't do much to stop them from causing problems.

ddtaylor 6y ago
I think the problem here is that it's training end-users to step outside of the normal security practices and normalizing that behavior. In the same way that most reputable companies would tell you "We'll never ask you for your password" and over time that has been well relegated to scammer-only territory. What if one day a company said "Hey, we're just gonna ask for your password this one time, but it's okay" - it mostly defeats the entire purpose of the protection scheme if users can easily be duped into not following it.
- fastball 6y ago
  Right, but what is the solution if this "normal security practice" relies on having a 3rd party sign your stuff but they refuse to do so, for non-security reasons?
  - cheaprentalyeti 6y ago
    Once again, it's demonstrated for us, trusted third parties are security holes.
- Animats 6y ago
  That's my point. This is just a slow migration to a new version, not something urgent. There's no reason to bypass normal procedures.
  - nullc 6y ago
    The old releases on the site are broken even worse, because they're signed with a revoked certificate. Getting something unsigned up was a strict improvement, particularly because there is no ETA for getting this fixed.

by nullc 6y ago

ddtaylor 6y ago

I think the problem here is that it's training end-users to step outside of the normal security practices and normalizing that behavior. In the same way that most reputable companies would tell you "We'll never ask you for your password" and over time that has been well relegated to scammer-only territory. What if one day a company said "Hey, we're just gonna ask for your password this one time, but it's okay" - it mostly defeats the entire purpose of the protection scheme if users can easily be duped into not following it.

fastball 6y ago
Right, but what is the solution if this "normal security practice" relies on having a 3rd party sign your stuff but they refuse to do so, for non-security reasons?
- cheaprentalyeti 6y ago
  Once again, it's demonstrated for us, trusted third parties are security holes.
Animats 6y ago
That's my point. This is just a slow migration to a new version, not something urgent. There's no reason to bypass normal procedures.
- nullc 6y ago
  The old releases on the site are broken even worse, because they're signed with a revoked certificate. Getting something unsigned up was a strict improvement, particularly because there is no ETA for getting this fixed.