6 ms·

Hopefully in the future when all users can install trusted root certificates and only run software that is signed by a descendent we won't have this bullshit.

munin 14y ago
sadly, every time we move towards this, people start screaming about "palladium" and "dee-arr-ehm" and "but then I won't be able to install Snarling Sealion!"
- krichman 14y ago
  Both are true IMO, we really need to be vigilant about whether we can install our own certs or not.
- qu4z-2 14y ago
  The issue is that it won't be nearly as effective as you think it will be.
elorant 14y ago
Until someone hacks the certificate and then all hell breaks loose.
bo1024 14y ago
Is this post sarcastic?
- krichman 14y ago
  No, signed binaries are wonderful for users. Centralised CA's and not allowing self-signed roots are the only thing that would be objectionable.
  - diminoten 14y ago
    What would you recommend the hurdle be for getting your software signed?
    - krichman 14y ago
      Whatever the CA sets as the barrier. Users can pick whatever CA they trust or whatever CA their technical friends and family recommends they trust.
      - betterunix 14y ago
        "Users can pick whatever CA they trust or whatever CA their technical friends and family recommends they trust." Which means you'll wind up with the situation we have with TLS: hundreds of CAs, all trusted by default, most not even remotely trustworthy. Users will have no idea about these CAs and so the CAs will never have to worry about being loose with certificates.
        krichman 14y ago
        I sure hope we'd be smarter about it this time. I envision something more like the average user chooses from, i.e., Canonical and Microsoft, while a more technical user would choose one of those and also install his own self-signed root as a CA.
      - diminoten 14y ago
        So you would have one or a group of companies gain full control over what programs are allowed to be installed on your operating system? You believe an amateur software developer should have to pay to get her app signed by a CA before she is able to distribute it? That someone else gets a say over whether or not a person can build an application? And what if that CA gets popped? What if that CA makes a mistake? Do you furthermore think that even semi-technical people will think about these things enough to pick individual CAs? There are a dozen problems with what you're saying, and I think you know it. What I really wonder is why you're coming into this conversation at such an intellectually dishonest angle, like you've never seen the arguments for/against what you're proposing before.
  - bo1024 14y ago
    I think I see your point, but I wonder if this idealized scenario would be achievable in practice anytime soon, and if it's worth the current issues to try for it.
  - jiggy2011 14y ago
    "Add this certificate for free porn!"
ewbuoi 14y ago
That sounds like a good way to kill innovation: make it impossible to distribute (and possibly develop) software without consent of a CA.
- klodolph 14y ago
  There is a middle ground. OS X default configuration only allows software to run if it is signed by a developer, unless you right-click on the application and select "open" through the contextual menu, in which case you are presented with the option to override it. I like this, and I am a software developer. (Windows has something like this too. I don't remember the details.)
  - krichman 14y ago
    I hate OS X's implementation. They need to allow third-party CA's. I don't want to choose between what Apple allows developers to do and "fuck it let it run free and do whatever it likes". Nor do I want the global choice in System Preferences to be between developers that paid $100 to Apple this year and Wild West.
    - chrisbolt 14y ago
      What would prevent malware authors from just signing with their own CA?
      - krichman 14y ago
        Users shouldn't install self-signed root certs unless they trust that root with access to all of their computer.
- krichman 14y ago
  "all users can install trusted root certificates" doesn't reject the notion of self-signed roots.
bcoates 14y ago
Since when can CAs determine bad intent? Besides, there are enough legitimate uses for webcam viewing software that you could just take a regular signed program and configure it in a deceptive manner. Modern web-browsers allow camera access without additional software, for example. I'm all for software being signed as a matter of routine but this is not something that it would help.
- krichman 14y ago
  They cannot, but they can revoke certificates from malware developers after the fact. And requiring a developer program would vastly reduce the number teenagers tricking people into installing a thing. Allowing self-signed roots would let more technical users manage their own security and install their own apps. A solution to configuration files is to include them in what is signed or not allow your software to have the webcam on without also showing a window explaining what is happening and a button to turn it off. Modern web browsers typically ask for permission to use the webcam beforehand, and you can always close that page. I guess there would still be shenanigans with signed binaries but there would be far fewer than what is going on here.
runjake 14y ago
Signed software doesn't matter when it comes to the most common methods of execution: Java, Flash, PDF exploits, Flash objects embedded in Microsoft Word documents currently bypass the sandboxing in both Word and Adobe Flash. In other words, this isn't going away.
- krichman 14y ago
  Sounds like they need a better sandbox :) Signing does matter. Those may still be exploitable to run arbitrary code, but you cannot write code to disk that will get executed on start-up. The victim would have to open the same PDF every time they use their computer.
- tomjen3 14y ago
  Read the article. They aren't clever enough to do that, they just get their users to install the software for them.
nodata 14y ago
Not sure if you're being serious. In case you are: http://www.linhadefensiva.com/2013/02/signing-malware-applications-apparently-a-security-industry-guideline/ http://www.linhadefensiva.com/2013/02/signing-malware-applic...

munin 14y ago

sadly, every time we move towards this, people start screaming about "palladium" and "dee-arr-ehm" and "but then I won't be able to install Snarling Sealion!"

krichman 14y ago
Both are true IMO, we really need to be vigilant about whether we can install our own certs or not.
qu4z-2 14y ago
The issue is that it won't be nearly as effective as you think it will be.

elorant 14y ago

Until someone hacks the certificate and then all hell breaks loose.

bo1024 14y ago

Is this post sarcastic?

krichman 14y ago
No, signed binaries are wonderful for users. Centralised CA's and not allowing self-signed roots are the only thing that would be objectionable.
- diminoten 14y ago
  What would you recommend the hurdle be for getting your software signed?
  - krichman 14y ago
    Whatever the CA sets as the barrier. Users can pick whatever CA they trust or whatever CA their technical friends and family recommends they trust.
    - betterunix 14y ago
      "Users can pick whatever CA they trust or whatever CA their technical friends and family recommends they trust." Which means you'll wind up with the situation we have with TLS: hundreds of CAs, all trusted by default, most not even remotely trustworthy. Users will have no idea about these CAs and so the CAs will never have to worry about being loose with certificates.
      - krichman 14y ago
        I sure hope we'd be smarter about it this time. I envision something more like the average user chooses from, i.e., Canonical and Microsoft, while a more technical user would choose one of those and also install his own self-signed root as a CA.
    - diminoten 14y ago
      So you would have one or a group of companies gain full control over what programs are allowed to be installed on your operating system? You believe an amateur software developer should have to pay to get her app signed by a CA before she is able to distribute it? That someone else gets a say over whether or not a person can build an application? And what if that CA gets popped? What if that CA makes a mistake? Do you furthermore think that even semi-technical people will think about these things enough to pick individual CAs? There are a dozen problems with what you're saying, and I think you know it. What I really wonder is why you're coming into this conversation at such an intellectually dishonest angle, like you've never seen the arguments for/against what you're proposing before.
- bo1024 14y ago
  I think I see your point, but I wonder if this idealized scenario would be achievable in practice anytime soon, and if it's worth the current issues to try for it.
- jiggy2011 14y ago
  "Add this certificate for free porn!"

ewbuoi 14y ago

That sounds like a good way to kill innovation: make it impossible to distribute (and possibly develop) software without consent of a CA.

klodolph 14y ago
There is a middle ground. OS X default configuration only allows software to run if it is signed by a developer, unless you right-click on the application and select "open" through the contextual menu, in which case you are presented with the option to override it. I like this, and I am a software developer. (Windows has something like this too. I don't remember the details.)
- krichman 14y ago
  I hate OS X's implementation. They need to allow third-party CA's. I don't want to choose between what Apple allows developers to do and "fuck it let it run free and do whatever it likes". Nor do I want the global choice in System Preferences to be between developers that paid $100 to Apple this year and Wild West.
  - chrisbolt 14y ago
    What would prevent malware authors from just signing with their own CA?
    - krichman 14y ago
      Users shouldn't install self-signed root certs unless they trust that root with access to all of their computer.
krichman 14y ago
"all users can install trusted root certificates" doesn't reject the notion of self-signed roots.

bcoates 14y ago

Since when can CAs determine bad intent? Besides, there are enough legitimate uses for webcam viewing software that you could just take a regular signed program and configure it in a deceptive manner. Modern web-browsers allow camera access without additional software, for example. I'm all for software being signed as a matter of routine but this is not something that it would help.

krichman 14y ago
They cannot, but they can revoke certificates from malware developers after the fact. And requiring a developer program would vastly reduce the number teenagers tricking people into installing a thing. Allowing self-signed roots would let more technical users manage their own security and install their own apps. A solution to configuration files is to include them in what is signed or not allow your software to have the webcam on without also showing a window explaining what is happening and a button to turn it off. Modern web browsers typically ask for permission to use the webcam beforehand, and you can always close that page. I guess there would still be shenanigans with signed binaries but there would be far fewer than what is going on here.

runjake 14y ago

Signed software doesn't matter when it comes to the most common methods of execution: Java, Flash, PDF exploits, Flash objects embedded in Microsoft Word documents currently bypass the sandboxing in both Word and Adobe Flash. In other words, this isn't going away.

krichman 14y ago
Sounds like they need a better sandbox :) Signing does matter. Those may still be exploitable to run arbitrary code, but you cannot write code to disk that will get executed on start-up. The victim would have to open the same PDF every time they use their computer.
tomjen3 14y ago
Read the article. They aren't clever enough to do that, they just get their users to install the software for them.

nodata 14y ago

Not sure if you're being serious. In case you are: http://www.linhadefensiva.com/2013/02/signing-malware-applications-apparently-a-security-industry-guideline/ http://www.linhadefensiva.com/2013/02/signing-malware-applic...