3 ms·
Hopefully Windows will remember that I downloaded the file from imagemagic.com check that the certificate matches the place I downloaded it from... Although...
by londons_explore 3y ago
Hopefully Windows will remember that I downloaded the file from imagemagic.com check that the certificate matches the place I downloaded it from...
Although... As long as downloads are always provided from the official domain via HTTPS, and the OS can keep track of that, I don't really see why the executable itself needs to be signed...
- tremon 3y agoimagemagick.org imagemagic.com That's a good way to illustrate the GP's point. As long as downloads are always provided from the official domain via HTTPS You are conflating control over the public website with control over the build/signing infrastructure. A good defense-in-depth strategy means that a compromise of one should not lead to an automatic compromise of the other.
- yread 3y agounless they use a cdn with a hostname like imagemagick-14.akamai.net
- nolongerthere 3y agoMost OS software is downloaded from code repositories like github or fosshub to save on networking costs, not to mention CDNs that are often used even when the link is on the software's website the file itself will often not be "coming from" that website.
- brnt 3y ago> Most OS software is downloaded from code repositories like github or fosshub to save on networking costs, [X] Doubt Do not underestimate the sheer number of people jamming in software names or descriptions into Google and getting their wares on the likes of softpedia.
- nolongerthere 3y agosame difference though, that's the equivalent of a CDN or fosshub. Its definitely not the author of the software.