3 ms·
Unless they are doing a code review, and security audit (actual Audit) then no it is just a cash grab and gate keeping
by phpisthebest 4y ago
Unless they are doing a code review, and security audit (actual Audit) then no it is just a cash grab and gate keeping
- jacobsenscott 4y agoYes, all certifications are just cash grabs - weather it is "organic" food, or "acme certified engineer" (replace acme with the megacorp or your choice), or pci or soc2 or ... Certifying is a good business to be in, but deadly boring.
- mike_hearn 4y agoThe point of code signing certificates is purely to establish developer identity. It says nothing about the code and in fact you can buy a signing certificate once and then sign as many binaries as you like without limit, automatically and locally. Code signing in modern operating systems does the same thing as having a secure origin for web apps or a DKIM key for email: it ties code to a stable long term identifier controlled by a specific person or group of people. It doesn't say anything about whether the results are good or bad, which is why Windows still learns reputations over certificates. If you sign software and distribute malware it'll learn that and you'll get blocked.