3 ms·

Yes, and rightly so. It's hard to even describe how historically bad they've been; they normalized and encouraged unsigned binaries, essentially viruses and wo

by jrm4 3y ago

Yes, and rightly so. It's hard to even describe how historically bad they've been; they normalized and encouraged unsigned binaries, essentially viruses and worms, and were NEVER punished.

hollerith 3y ago
What should the punishment for Arch, Debian and Fedora be, then? Not only are unsigned binaries normal there, but as far as I know, the infrastructure doesn't even exist to check the signature of a binary on execution.
- tapoxi 3y ago
  I mean Debian and Fedora (not an arch user) sign their packages with GPG. It's a higher level up but effectively the same thing.
  - tatersolid 3y ago
    A runtime signature check is far more secure than an install-time signature check. On Linux you can swap a binary with an evil version using one of a million local privilege escalations available and nobody would ever know unless you have additional tripwire-style tooling set up.
- rc00 3y ago
  The repositories support signing so binaries that are sourced from these repositories are verified by the associated signatures during installation. If you trust the installation, would you include the execution in that same trust? Windows does not include signed repositories (or any that I know of) by default. (I could be wrong about that but if it does exist, the software collection is nowhere as vast as the distro repositories.) 1. Debian - SecureApt - https://wiki.debian.org/SecureApt https://wiki.debian.org/SecureApt 2. Arch - pacman/Package signing - https://wiki.archlinux.org/title/Pacman/Package_signing https://wiki.archlinux.org/title/Pacman/Package_signing 3. Fedora - RPM - Checking Package Signatures - https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators-guide/RPM/#s1-check-rpm-sig https://docs.fedoraproject.org/en-US/fedora/latest/system-ad...
  - nullindividual 3y ago
    Windows does not generally have the concept of a 'repository' (WinGet excluded, but that's fairly new). The Microsoft Store is the closest thing to a repo, and those are signed. Everything coming from Windows Update is also signed by a public CA.
- jrm4 3y ago
  None, but the reasons are more legal than technical. None of those projects have come close to Microsoft in terms of creating a product, for pay, that average people reasonably rely on. Again, using a legal definition of reasonably; a widely used and paid for product can be held to something like a "merchantability" standard - especially if Microsoft has ever claimed their product to be safe and secure, which I'm fairly certain they have.

by jrm4 3y ago

Yes, and rightly so. It's hard to even describe how historically bad they've been; they normalized and encouraged unsigned binaries, essentially viruses and worms, and were NEVER punished.

hollerith 3y ago

What should the punishment for Arch, Debian and Fedora be, then? Not only are unsigned binaries normal there, but as far as I know, the infrastructure doesn't even exist to check the signature of a binary on execution.

tapoxi 3y ago
I mean Debian and Fedora (not an arch user) sign their packages with GPG. It's a higher level up but effectively the same thing.
- tatersolid 3y ago
  A runtime signature check is far more secure than an install-time signature check. On Linux you can swap a binary with an evil version using one of a million local privilege escalations available and nobody would ever know unless you have additional tripwire-style tooling set up.
rc00 3y ago
The repositories support signing so binaries that are sourced from these repositories are verified by the associated signatures during installation. If you trust the installation, would you include the execution in that same trust? Windows does not include signed repositories (or any that I know of) by default. (I could be wrong about that but if it does exist, the software collection is nowhere as vast as the distro repositories.) 1. Debian - SecureApt - https://wiki.debian.org/SecureApt https://wiki.debian.org/SecureApt 2. Arch - pacman/Package signing - https://wiki.archlinux.org/title/Pacman/Package_signing https://wiki.archlinux.org/title/Pacman/Package_signing 3. Fedora - RPM - Checking Package Signatures - https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators-guide/RPM/#s1-check-rpm-sig https://docs.fedoraproject.org/en-US/fedora/latest/system-ad...
- nullindividual 3y ago
  Windows does not generally have the concept of a 'repository' (WinGet excluded, but that's fairly new). The Microsoft Store is the closest thing to a repo, and those are signed. Everything coming from Windows Update is also signed by a public CA.
jrm4 3y ago
None, but the reasons are more legal than technical. None of those projects have come close to Microsoft in terms of creating a product, for pay, that average people reasonably rely on. Again, using a legal definition of reasonably; a widely used and paid for product can be held to something like a "merchantability" standard - especially if Microsoft has ever claimed their product to be safe and secure, which I'm fairly certain they have.