3 ms·

> There is no provenance, no chain-of-trust. We should've probably started with the fact that I despise security policies based on provenance, chains of trust,

> There is no provenance, no chain-of-trust. We should've probably started with the fact that I despise security policies based on provenance, chains of trust, public key infrastructure, and third parties. This kind of "security" feels extremely fragile and unnecessarily centralized. We somehow live with how SSH identifies servers by their keys, with no third-party verification, and consider that an okay level of security. Why can't we use the same approach for TLS and for executable signatures? What's so fundamentally different that third parties are required in these cases?

sbuk 4y ago
SSH doesn’t rely on PKI. Using SSH certificates is a password replacement for accessing remote services. While it is a kind of identity verification, its purpose is not the same an application signing. Self signing is open to too much abuse. The whole point of signing is that the provenance can be verified (yes, checksums are a thing) and that the signing can be revoked should something bad happen. Notarising code is the process of a third party verifying your identity. So rather than saying, “hey, you can trust me”, you are asking a third party to vet and prove that you are trustworthy. If you can’t see the value in that for all parties - including the most important party, your customers - then that’s up to you. No sane SOC will allow unsigned or self-signed binaries. Consumers with the slightest bit of savvy will not run unsigned or self-signed binaries, and OS vendors need to take care of the rest. Thinking of the Confidentiality, Integrity and Availability triad, your solution is unworkable.
- grishka 4y ago
  Everyone used to run unsigned binaries all the time for the entire previous history of computing and somehow the hell didn't break loose. What changed? > Consumers with the slightest bit of savvy will not run unsigned or self-signed binaries I'm a "consumer with the slightest bit of savvy" and I despise code signing schemes that care about the signing identity, so you're already wrong. I absolutely will run unsigned and self-signed binaries. I trust myself and my own judgement more than I do anyone else in the entire universe.

sbuk 4y ago

SSH doesn’t rely on PKI. Using SSH certificates is a password replacement for accessing remote services. While it is a kind of identity verification, its purpose is not the same an application signing. Self signing is open to too much abuse. The whole point of signing is that the provenance can be verified (yes, checksums are a thing) and that the signing can be revoked should something bad happen. Notarising code is the process of a third party verifying your identity. So rather than saying, “hey, you can trust me”, you are asking a third party to vet and prove that you are trustworthy. If you can’t see the value in that for all parties - including the most important party, your customers - then that’s up to you. No sane SOC will allow unsigned or self-signed binaries. Consumers with the slightest bit of savvy will not run unsigned or self-signed binaries, and OS vendors need to take care of the rest. Thinking of the Confidentiality, Integrity and Availability triad, your solution is unworkable.

grishka 4y ago
Everyone used to run unsigned binaries all the time for the entire previous history of computing and somehow the hell didn't break loose. What changed? > Consumers with the slightest bit of savvy will not run unsigned or self-signed binaries I'm a "consumer with the slightest bit of savvy" and I despise code signing schemes that care about the signing identity, so you're already wrong. I absolutely will run unsigned and self-signed binaries. I trust myself and my own judgement more than I do anyone else in the entire universe.