3 ms·

Yeah, me. It ensures that the binary you have is really from who it claims to be from, which can also be ensured by acquiring it through a secure channel (e.g.

Yeah, me. It ensures that the binary you have is really from who it claims to be from, which can also be ensured by acquiring it through a secure channel (e.g. an HTTPS-enabled website or package repository). It doesn't give you any guarantees about the binary being free of malware - only that it's really published by the entity you got it from. Granted: Now an actor who wants to inject malware has to hijack the build process rather than only the website, but somehow I'm not convinced that's worth 600$/year and a lot of technical effort that could be put into securing the distribution chain.

deleted 3y ago
[deleted]
kenjackson 3y ago
$600/year buys you how much you can put into securing the distribution chain? 3 hours of dev time? If you can’t put $600/year into signing your binary, I don’t know how much effort you’re going to put into securing a distribution chain.
- michaelt 3y ago
  So you're donating $600/year to ImageMagik for them to get a code signing certificate, right? Oh, you're not? Then why should the volunteer developers do so?
  - kenjackson 3y ago
    I don’t use ImageMagik. I don’t care if they shutdown the whole project. But if you told me Madden was going to shutdown due to $600/year I could raise that amongst my small group of friends so that we could just play the game.
    - TeMPOraL 3y ago
      Which is exactly why I think money is not the issue here. That $600 is trivial to raise for a project this widely used, should the need arise. The issue is likely about having to pay in the first place, and the reason behind it.
      - kenjackson 3y ago
        They don’t have to pay it. They don’t have to have code signed. And what’s the issue with the reason behind it? The CA/B Forum made this decision after a lot of deliberation. What’s a better partial solution to this problem given the state of the world today?

deleted 3y ago

[deleted]

kenjackson 3y ago

$600/year buys you how much you can put into securing the distribution chain? 3 hours of dev time? If you can’t put $600/year into signing your binary, I don’t know how much effort you’re going to put into securing a distribution chain.

michaelt 3y ago
So you're donating $600/year to ImageMagik for them to get a code signing certificate, right? Oh, you're not? Then why should the volunteer developers do so?
- kenjackson 3y ago
  I don’t use ImageMagik. I don’t care if they shutdown the whole project. But if you told me Madden was going to shutdown due to $600/year I could raise that amongst my small group of friends so that we could just play the game.
  - TeMPOraL 3y ago
    Which is exactly why I think money is not the issue here. That $600 is trivial to raise for a project this widely used, should the need arise. The issue is likely about having to pay in the first place, and the reason behind it.
    - kenjackson 3y ago
      They don’t have to pay it. They don’t have to have code signed. And what’s the issue with the reason behind it? The CA/B Forum made this decision after a lot of deliberation. What’s a better partial solution to this problem given the state of the world today?