3 ms·

I haven't been involved in this area, so I truly have no horse in this race. But avoiding malware strikes me as a hard-to-solve problem, particular for non-ope

I haven't been involved in this area, so I truly have no horse in this race. But avoiding malware strikes me as a hard-to-solve problem, particular for non-open-source software. Is it possible that paid-for-certification is one of the last-bad known approaches?

phpisthebest 4y ago
Unless they are doing a code review, and security audit (actual Audit) then no it is just a cash grab and gate keeping
- jacobsenscott 4y ago
  Yes, all certifications are just cash grabs - weather it is "organic" food, or "acme certified engineer" (replace acme with the megacorp or your choice), or pci or soc2 or ... Certifying is a good business to be in, but deadly boring.
- mike_hearn 4y ago
  The point of code signing certificates is purely to establish developer identity. It says nothing about the code and in fact you can buy a signing certificate once and then sign as many binaries as you like without limit, automatically and locally. Code signing in modern operating systems does the same thing as having a secure origin for web apps or a DKIM key for email: it ties code to a stable long term identifier controlled by a specific person or group of people. It doesn't say anything about whether the results are good or bad, which is why Windows still learns reputations over certificates. If you sign software and distribute malware it'll learn that and you'll get blocked.
creshal 4y ago
With how eager developers seem to be pushing certification keys into public github repositories or open S3 buckets, it's almost easier for criminals to get a valid signing key than it is for honest developers, especially non-profit entities. On top of that, the certification process isn't great either. Even honest certificate authorities have occasionally cut a corner too many and allowed malicious certificates to be printed; and there's some rather sketchy authorities that don't take the requirements too seriously. (StartCom e.g. offered to ignore the requirements for bribes years before they finally got removed from trust databases.) So I don't think that certificates offer any security benefit. Might as well drop them.
- mike_hearn 4y ago
  Windows signing keys are often protected by hardware security modules (often on USB devices), so you can't push them to GitHub repositories. Malware authors spend a lot of time trying to steal signing keys exactly to try and avoid AV detection, so it's not worthless. It's certainly not easier for criminals to get one than honest developers.
CoastalCoder 4y ago
> Is it possible that paid-for-certification is one of the last-bad known approaches? Too late to edit, but I meant to write "... least-bad ...".

phpisthebest 4y ago

Unless they are doing a code review, and security audit (actual Audit) then no it is just a cash grab and gate keeping

jacobsenscott 4y ago
Yes, all certifications are just cash grabs - weather it is "organic" food, or "acme certified engineer" (replace acme with the megacorp or your choice), or pci or soc2 or ... Certifying is a good business to be in, but deadly boring.
mike_hearn 4y ago
The point of code signing certificates is purely to establish developer identity. It says nothing about the code and in fact you can buy a signing certificate once and then sign as many binaries as you like without limit, automatically and locally. Code signing in modern operating systems does the same thing as having a secure origin for web apps or a DKIM key for email: it ties code to a stable long term identifier controlled by a specific person or group of people. It doesn't say anything about whether the results are good or bad, which is why Windows still learns reputations over certificates. If you sign software and distribute malware it'll learn that and you'll get blocked.

creshal 4y ago

With how eager developers seem to be pushing certification keys into public github repositories or open S3 buckets, it's almost easier for criminals to get a valid signing key than it is for honest developers, especially non-profit entities. On top of that, the certification process isn't great either. Even honest certificate authorities have occasionally cut a corner too many and allowed malicious certificates to be printed; and there's some rather sketchy authorities that don't take the requirements too seriously. (StartCom e.g. offered to ignore the requirements for bribes years before they finally got removed from trust databases.) So I don't think that certificates offer any security benefit. Might as well drop them.

mike_hearn 4y ago
Windows signing keys are often protected by hardware security modules (often on USB devices), so you can't push them to GitHub repositories. Malware authors spend a lot of time trying to steal signing keys exactly to try and avoid AV detection, so it's not worthless. It's certainly not easier for criminals to get one than honest developers.

CoastalCoder 4y ago

> Is it possible that paid-for-certification is one of the last-bad known approaches? Too late to edit, but I meant to write "... least-bad ...".