4 ms·

Code signing certs are unfortunately expensive

by adzm 9mo ago

firesteelrain 9mo ago
$700+ at Sectigo for two years Something of Notepad++ size might think about it now
- abeyer 9mo ago
  "of Notepad++ size" is basically one guy in his free time, no?
  - eviks 9mo ago
    "But look at those downloads, they magically print money"
    - firesteelrain 9mo ago
      Notepad++ is Windows-based and could use the Windows store instead of the built in updater. Microsoft charges a one time fee. It would pass SmartScreen checks. His website has a bunch of ads integrated which I assume are there to help pay for hosting. Mr. Ho already has hosting charges and he uses GitHub. For those who use GitHub, he could continue his GnuPG method for signing. Additionally, GitHub integrates with Sigstore. Windows wouldn’t trust his signature but at least there would be better traceability. Version 8.8.7 labeled “authenticity guaranteed” is a step in that direction. The real “issue” here was his outside hosting platform for updates from my reading of the article.
- hjoutfbkfd 9mo ago
  the issue was not the money, but that it was difficult to get a certificate without having some sort of legal entity
  - firesteelrain 9mo ago
    Certum.eu has this figured out. https://support.certum.eu/en/code-signing-required-documents/ https://support.certum.eu/en/code-signing-required-documents... https://shop.certum.eu/open-source-code-signing-on-simplysign.html https://shop.certum.eu/open-source-code-signing-on-simplysig... $49 (EU) Gross
  - _zagj 9mo ago
    Delaware LLCs are "cheap," but you're still looking at $300-500 a year in fees.
  - Chaosvex 9mo ago
    It was negligence. You don't need a certificate to prevent update tampering.
1una 9mo ago
$0 at SignPath. Quite a few OSS projects use it.
Chaosvex 9mo ago
You don't even need a certificate to prevent update tampering like this. The updates could have shipped with an ECDSA signature and this wouldn't have happened. It's also free and doable in an afternoon.

Code signing certs are unfortunately expensive

by adzm 9mo ago

Code signing certs are unfortunately expensive

firesteelrain 9mo ago

$700+ at Sectigo for two years Something of Notepad++ size might think about it now

abeyer 9mo ago
"of Notepad++ size" is basically one guy in his free time, no?
- eviks 9mo ago
  "But look at those downloads, they magically print money"
  - firesteelrain 9mo ago
    Notepad++ is Windows-based and could use the Windows store instead of the built in updater. Microsoft charges a one time fee. It would pass SmartScreen checks. His website has a bunch of ads integrated which I assume are there to help pay for hosting. Mr. Ho already has hosting charges and he uses GitHub. For those who use GitHub, he could continue his GnuPG method for signing. Additionally, GitHub integrates with Sigstore. Windows wouldn’t trust his signature but at least there would be better traceability. Version 8.8.7 labeled “authenticity guaranteed” is a step in that direction. The real “issue” here was his outside hosting platform for updates from my reading of the article.
hjoutfbkfd 9mo ago
the issue was not the money, but that it was difficult to get a certificate without having some sort of legal entity
- firesteelrain 9mo ago
  Certum.eu has this figured out. https://support.certum.eu/en/code-signing-required-documents/ https://support.certum.eu/en/code-signing-required-documents... https://shop.certum.eu/open-source-code-signing-on-simplysign.html https://shop.certum.eu/open-source-code-signing-on-simplysig... $49 (EU) Gross
- _zagj 9mo ago
  Delaware LLCs are "cheap," but you're still looking at $300-500 a year in fees.
- Chaosvex 9mo ago
  It was negligence. You don't need a certificate to prevent update tampering.

1una 9mo ago

$0 at SignPath. Quite a few OSS projects use it.

Chaosvex 9mo ago

You don't even need a certificate to prevent update tampering like this. The updates could have shipped with an ECDSA signature and this wouldn't have happened. It's also free and doable in an afternoon.