News for hackers. Stuff that matters.

A comment on Notepad++ drops code signing for its releases. Parent comment

Re:Notepad++ drops code signing for its releases by Spivak on Thursday March 07, 2019 @01:47PM (#19330870)
"but it doesn't prove anything other than that a particular build was made by a certain person."

But that's what trust actually is. This IRL person or identity, that I trust, vouches for the non-maliciousness of this application.

[ Parent | on HN ]
Re:Notepad++ drops code signing for its releases by Nasrudith on Thursday March 07, 2019 @03:49PM (#19332211)
Except the core problem is key propagation because just anyone can have a key - paid or free if you don't know the source. It says it is from Globe Software and it matches with the provided key. It doesn't tell you if they really are Globe Software, let alone if they are a trustworthy company in the first place.
[ Parent | on HN ]