Re:Notepad++ drops code signing for its releases
by close04 on Thursday March 07, 2019 @02:06PM
(#19331075)
> I will always put more trust to downloads form web sites that have an owner, than apps coming from an app store.
The article is about signing the Windows binary that you download from the developer's site so when the UAC dialog pops up on installation it shows a valid publisher. Nothing to do with an app store.
> The app stores
Again, different topic.
> Certifactes are a fallacy that tell nothing about the security of the app.
Actually they do. It's a 0 effort way for the user to tell that the installer was not modified between compilation and installation. How do you tell that the developer's site wasn't hacked and the installer doesn't have some bundled malware?
> Also why do all security experts want to shove their security agenda to the world ?
Because that 1 million computer botnet attacking your site may just be made up of a lot of people who don't know what certificates are for, how to check if a download is legit, etc.
The article is about signing the Windows binary that you download from the developer's site so when the UAC dialog pops up on installation it shows a valid publisher. Nothing to do with an app store.
> The app stores
Again, different topic.
> Certifactes are a fallacy that tell nothing about the security of the app.
Actually they do. It's a 0 effort way for the user to tell that the installer was not modified between compilation and installation. How do you tell that the developer's site wasn't hacked and the installer doesn't have some bundled malware?
> Also why do all security experts want to shove their security agenda to the world ?
Because that 1 million computer botnet attacking your site may just be made up of a lot of people who don't know what certificates are for, how to check if a download is legit, etc.