4 ms·

The whole point of digital signing is to verify and have strong trust in the provenance of the code. This requires identity validation and controls for it to a

The whole point of digital signing is to verify and have strong trust in the provenance of the code. This requires identity validation and controls for it to actually work, which is fundamentally incompatible with a Let's Encrypt-style pretend-CA. This means storage of keys in hardware. Otherwise code signing keys are stolen and used for malware distribution in high profile attacks. This happened one too many times hence the more stringent requirements. Ironically these guys want their cake and eat it too, there is no reason they couldn't just manually sign release builds which come once in a while. Many small OSS projects do this. No, they want full automation with an organization cert and now are complaining about meeting the requirements for that.

cookiengineer 3y ago
The whole point of identity verification is pointless, given LOLbins and LOLdrivers that are never updated nor fixed. I wish we had a cryptographic verification mechanism based on code and reproducibility of their builds, and local-sensitive hashing mechanisms rather than the current ones. Technically this might actually be a decentralized ledging use case that makes sense.
gary_0 3y ago
A certificate that says "this installer really did come from the owner of exampleapp.com" is better than users just trusting whatever random file came up in a Google search. And meanwhile, in Linux land, people will install things by piping curl into bash[0][1], so the bar is just not that high. And the ultimate answer to security will come from better app sandboxing, not from charging every native-app developer in the world $700/year for a code signing certificate. [0] https://docs.chef.io/chef_install_script/ https://docs.chef.io/chef_install_script/ [1] https://github.com/zyedidia/micro#quick-install-script https://github.com/zyedidia/micro#quick-install-script
- charcircuit 3y ago
  >meanwhile, in Linux land Just because some operating systems are decades behind on security that does not mean that security does not matter.

cookiengineer 3y ago

The whole point of identity verification is pointless, given LOLbins and LOLdrivers that are never updated nor fixed. I wish we had a cryptographic verification mechanism based on code and reproducibility of their builds, and local-sensitive hashing mechanisms rather than the current ones. Technically this might actually be a decentralized ledging use case that makes sense.

gary_0 3y ago

A certificate that says "this installer really did come from the owner of exampleapp.com" is better than users just trusting whatever random file came up in a Google search. And meanwhile, in Linux land, people will install things by piping curl into bash[0][1], so the bar is just not that high. And the ultimate answer to security will come from better app sandboxing, not from charging every native-app developer in the world $700/year for a code signing certificate. [0] https://docs.chef.io/chef_install_script/ https://docs.chef.io/chef_install_script/ [1] https://github.com/zyedidia/micro#quick-install-script https://github.com/zyedidia/micro#quick-install-script

charcircuit 3y ago
>meanwhile, in Linux land Just because some operating systems are decades behind on security that does not mean that security does not matter.