News for hackers. Stuff that matters.

A comment on Microsoft comes under blistering criticism for “grossly irresponsible” security. Parent comment

Re:Microsoft comes under blistering criticism for “grossly i... by rc00 on Wednesday August 02, 2023 @11:02PM (#36980860)
The repositories support signing so binaries that are sourced from these repositories are verified by the associated signatures during installation. If you trust the installation, would you include the execution in that same trust? Windows does not include signed repositories (or any that I know of) by default. (I could be wrong about that but if it does exist, the software collection is nowhere as vast as the distro repositories.)

1. Debian - SecureApt - https://wiki.debian.org/SecureApt

2. Arch - pacman/Package signing - https://wiki.archlinux.org/title/Pacman/Package_signing

3. Fedora - RPM - Checking Package Signatures - https://docs.fedoraproject.org/en-US/fedora/latest/system-ad...

[ Parent | on HN ]
Re:Microsoft comes under blistering criticism for “grossly i... by nullindividual on Wednesday August 02, 2023 @11:27PM (#36981000)
Windows does not generally have the concept of a 'repository' (WinGet excluded, but that's fairly new). The Microsoft Store is the closest thing to a repo, and those are signed.

Everything coming from Windows Update is also signed by a public CA.

[ Parent | on HN ]