5 ms·
$600/year buys you how much you can put into securing the distribution chain? 3 hours of dev time? If you can’t put $600/year into signing your binary, I don’
by kenjackson 3y ago
$600/year buys you how much you can put into securing the distribution chain? 3 hours of dev time?
If you can’t put $600/year into signing your binary, I don’t know how much effort you’re going to put into securing a distribution chain.
- michaelt 3y agoSo you're donating $600/year to ImageMagik for them to get a code signing certificate, right? Oh, you're not? Then why should the volunteer developers do so?
- kenjackson 3y agoI don’t use ImageMagik. I don’t care if they shutdown the whole project. But if you told me Madden was going to shutdown due to $600/year I could raise that amongst my small group of friends so that we could just play the game.
- TeMPOraL 3y agoWhich is exactly why I think money is not the issue here. That $600 is trivial to raise for a project this widely used, should the need arise. The issue is likely about having to pay in the first place, and the reason behind it.
- kenjackson 3y agoThey don’t have to pay it. They don’t have to have code signed. And what’s the issue with the reason behind it? The CA/B Forum made this decision after a lot of deliberation. What’s a better partial solution to this problem given the state of the world today?