5 ms·

When I last installed 7-zip, I had a merry time checking I had a genuine copy looking at SHA256 values from various sketchy websites as the installer wasn't sig

by billpg 4y ago

When I last installed 7-zip, I had a merry time checking I had a genuine copy looking at SHA256 values from various sketchy websites as the installer wasn't signed. I persisted as 7-zip was just too darn useful but the experience puts me off upgrading.

smileybarry 4y ago
Yeah, I'm not sure why 7-zip is still unsigned. Code signing certificates are cheaper now and it's much easier to check that than random hashes, not to mention reputation trusting by AVs and such.
- voltagex_ 4y ago
  Where are the cheap certificates? It still won't guarantee you get to skip the bad smartscreen prompt, though.
  - smileybarry 4y ago
    Well, relatively cheap. You have some Comodo/Sectigo/DigiCert resellers selling for $70-$100/year. And it won't instantly skip SmartScreen (that requires EV which is $300+) but it helps to establish reputation, i.e.: if you consistently release safe software signed with a cert named X, then SmartScreen and co. learn to give a good starting reputation to binaries signed by X.
    - aaaaaaaaata 4y ago
      ...
  - arthurfm 4y ago
    Linux Foundation unveils Sigstore — a Let's Encrypt for code signing [1] [2] > The Linux Foundation, Red Hat, Google, and Purdue have unveiled the free 'sigstore' service that lets developers code-sign and verify open source software to prevent supply-chain attacks. > As demonstrated by the recent dependency confusion attacks and malicious typo-squatted NPM packages, the open-source ecosystem is commonly targeted for supply-chain attacks. > To pull these attacks off, threat actors will create malicious open-source packages and upload them to public repositories using names similar to popular legitimate packages. If a developer mistakenly includes the malicious package in their own project, malicious code will automatically be executed when the project is built. > To prevent these types of attacks, 'sigstore' will be a free-to-use non-profit software signing service that allows developers to sign open-source software and verify their authenticity. > "You can think of it like Let’s Encrypt for Code Signing. Just like how Let’s Encrypt provides free certificates and automation tooling for HTTPS, sigstore provides free certificates and tooling to automate and verify signatures of source code." [1] https://www.bleepingcomputer.com/news/security/linux-foundation-unveils-sigstore-a-lets-encrypt-for-code-signing/ https://www.bleepingcomputer.com/news/security/linux-foundat... [2] https://www.sigstore.dev https://www.sigstore.dev
    - account42 4y ago
      Coming Soon™ Not available to us plebs and vague enough that it isn't even clear if they provide Windows-compatible code signing certs.
- account42 4y ago
  The entitlement to demand that someone providing free software must pay money to Microsoft and its partners for the priviledge... Fuck that. 7-zip.org has official download links - you can expect those to be the official binaries from 7-zip.org - and a code sigining certificate won't really tell you more than that. If you want Microsoft to gatekeep your software then please complain to Microsoft if that inconveniences you, not to anyone else.
  - badsectoracula 4y ago
    Amen. It is mind boggling that there are programmers out there who support these certificate cartels.
  - smileybarry 4y ago
    Demand? Entitlement? Suggesting a QoL improvement is “demanding”? And I’d happily donate to make it happen but there’s no donation link or option anywhere. > 7-zip.org has official download links - you can expect those to be the official binaries from 7-zip.org - and a code sigining certificate won't really tell you more than that. Have you heard of compromised download servers? At least signing it on your machine before distribution means you can guarantee it hasn’t changed. (And yes, you can just change the hash on the website, it’s the same server)

by billpg 4y ago

smileybarry 4y ago

Yeah, I'm not sure why 7-zip is still unsigned. Code signing certificates are cheaper now and it's much easier to check that than random hashes, not to mention reputation trusting by AVs and such.

voltagex_ 4y ago
Where are the cheap certificates? It still won't guarantee you get to skip the bad smartscreen prompt, though.
- smileybarry 4y ago
  Well, relatively cheap. You have some Comodo/Sectigo/DigiCert resellers selling for $70-$100/year. And it won't instantly skip SmartScreen (that requires EV which is $300+) but it helps to establish reputation, i.e.: if you consistently release safe software signed with a cert named X, then SmartScreen and co. learn to give a good starting reputation to binaries signed by X.
  - aaaaaaaaata 4y ago
    ...
- arthurfm 4y ago
  Linux Foundation unveils Sigstore — a Let's Encrypt for code signing [1] [2] > The Linux Foundation, Red Hat, Google, and Purdue have unveiled the free 'sigstore' service that lets developers code-sign and verify open source software to prevent supply-chain attacks. > As demonstrated by the recent dependency confusion attacks and malicious typo-squatted NPM packages, the open-source ecosystem is commonly targeted for supply-chain attacks. > To pull these attacks off, threat actors will create malicious open-source packages and upload them to public repositories using names similar to popular legitimate packages. If a developer mistakenly includes the malicious package in their own project, malicious code will automatically be executed when the project is built. > To prevent these types of attacks, 'sigstore' will be a free-to-use non-profit software signing service that allows developers to sign open-source software and verify their authenticity. > "You can think of it like Let’s Encrypt for Code Signing. Just like how Let’s Encrypt provides free certificates and automation tooling for HTTPS, sigstore provides free certificates and tooling to automate and verify signatures of source code." [1] https://www.bleepingcomputer.com/news/security/linux-foundation-unveils-sigstore-a-lets-encrypt-for-code-signing/ https://www.bleepingcomputer.com/news/security/linux-foundat... [2] https://www.sigstore.dev https://www.sigstore.dev
  - account42 4y ago
    Coming Soon™ Not available to us plebs and vague enough that it isn't even clear if they provide Windows-compatible code signing certs.
account42 4y ago
The entitlement to demand that someone providing free software must pay money to Microsoft and its partners for the priviledge... Fuck that. 7-zip.org has official download links - you can expect those to be the official binaries from 7-zip.org - and a code sigining certificate won't really tell you more than that. If you want Microsoft to gatekeep your software then please complain to Microsoft if that inconveniences you, not to anyone else.
- badsectoracula 4y ago
  Amen. It is mind boggling that there are programmers out there who support these certificate cartels.
- smileybarry 4y ago
  Demand? Entitlement? Suggesting a QoL improvement is “demanding”? And I’d happily donate to make it happen but there’s no donation link or option anywhere. > 7-zip.org has official download links - you can expect those to be the official binaries from 7-zip.org - and a code sigining certificate won't really tell you more than that. Have you heard of compromised download servers? At least signing it on your machine before distribution means you can guarantee it hasn’t changed. (And yes, you can just change the hash on the website, it’s the same server)