News for hackers. Stuff that matters.

A comment on Notepad++ drops code signing for its releases. Parent comment

Re:Notepad++ drops code signing for its releases by meditate on Thursday March 07, 2019 @12:51PM (#19330255)
It doesn't make it inherently safe, but if you are attempting to prove your builds are safe then it is impossible for anyone else to verify that without the source. See the thread on Debian reproducible builds from earlier this week for more discussion on this topic: https://news.ycombinator.com/item?id=19310638

Code signing is something you can do on both open-source or closed-source, but it doesn't prove anything other than that a particular build was made by a certain person.

[ Parent | on HN ]
Re:Notepad++ drops code signing for its releases by Spivak on Thursday March 07, 2019 @01:47PM (#19330870)
"but it doesn't prove anything other than that a particular build was made by a certain person."

But that's what trust actually is. This IRL person or identity, that I trust, vouches for the non-maliciousness of this application.

[ Parent | on HN ]
Re:Notepad++ drops code signing for its releases by Nasrudith on Thursday March 07, 2019 @03:49PM (#19332211)
Except the core problem is key propagation because just anyone can have a key - paid or free if you don't know the source. It says it is from Globe Software and it matches with the provided key. It doesn't tell you if they really are Globe Software, let alone if they are a trustworthy company in the first place.
[ Parent | on HN ]