2 ms·

Well, code-signing with a certificate authority involved works only if you can trust the certificate authority AND the developer that signed the binary. Debian

Well, code-signing with a certificate authority involved works only if you can trust the certificate authority AND the developer that signed the binary. Debian/Ubuntu's main repositories work by vetting for the maintainers that package the official binaries, with the proper keys being distributed as part of those distros. OS X works by validating if the key is a developer registered with Apple. No system is perfect, I'm sure there's plenty of malware available for Debian/Ubuntu or OS X, including repackaged popular software that looks almost legit to the unsuspecting eyes, but this process works much better if you can have a second authority (in addition to the certificate authority) that is able to say "this developer did bad things so his key is no longer considered valid" and this authority must be the maintainer/governor of the operating system as there's nobody else that really cares about malware. For Debian/Ubuntu that would be the community / Canonical, for Windows that would be Microsoft, for OS X that would be Apple.

einhverfr 13y ago
I think what's missing actually is an ability to really cancel a certificate and issue a new one for a piece of software. This doesn't work with Windows code signing for a number of economic and technical reasons. For example, you can't verify that a certificate hasn't been revoked when installing offline, and you can't resign packages you have given to other developers to distribute. So what this means is that code signing does not work for redistributable software or for hard media very well. Ideally it would work if you have a single trusted online source for signatures but then this renders the system far less useful for many applications. I am not sold on code signing. We sign our code and centrally publish the signatures separate from the code, so that while the code may be signed, the signatures can be updated if we need to change the key. It's not that the developer does something bad but that if you can't revoke a compromised key effectively and safely for all parties, then you can't revoke it at all. And code signing in its current incarnations (whether with RPMs or MSIs) has serious problems there.

einhverfr 13y ago

I think what's missing actually is an ability to really cancel a certificate and issue a new one for a piece of software. This doesn't work with Windows code signing for a number of economic and technical reasons. For example, you can't verify that a certificate hasn't been revoked when installing offline, and you can't resign packages you have given to other developers to distribute. So what this means is that code signing does not work for redistributable software or for hard media very well. Ideally it would work if you have a single trusted online source for signatures but then this renders the system far less useful for many applications. I am not sold on code signing. We sign our code and centrally publish the signatures separate from the code, so that while the code may be signed, the signatures can be updated if we need to change the key. It's not that the developer does something bad but that if you can't revoke a compromised key effectively and safely for all parties, then you can't revoke it at all. And code signing in its current incarnations (whether with RPMs or MSIs) has serious problems there.