News for hackers. Stuff that matters.

A comment on The Windows installer of ImageMagick will no longer be signed. Parent comment

Re:The Windows installer of ImageMagick will no longer be si... by londons_explore on Sunday October 29, 2023 @07:40AM (#38057588)
Hopefully Windows will remember that I downloaded the file from imagemagic.com check that the certificate matches the place I downloaded it from...

Although... As long as downloads are always provided from the official domain via HTTPS, and the OS can keep track of that, I don't really see why the executable itself needs to be signed...

[ Parent | on HN ]
Re:The Windows installer of ImageMagick will no longer be si... by tremon on Sunday October 29, 2023 @08:57AM (#38058143)
imagemagick.org

imagemagic.com

That's a good way to illustrate the GP's point.

As long as downloads are always provided from the official domain via HTTPS

You are conflating control over the public website with control over the build/signing infrastructure. A good defense-in-depth strategy means that a compromise of one should not lead to an automatic compromise of the other.

[ Parent | on HN ]
Re:The Windows installer of ImageMagick will no longer be si... by yread on Sunday October 29, 2023 @10:10AM (#38058814)
unless they use a cdn with a hostname like imagemagick-14.akamai.net
[ Parent | on HN ]
Re:The Windows installer of ImageMagick will no longer be si... by nolongerthere on Sunday October 29, 2023 @11:57AM (#38059774)
Most OS software is downloaded from code repositories like github or fosshub to save on networking costs, not to mention CDNs that are often used even when the link is on the software's website the file itself will often not be "coming from" that website.
[ Parent | on HN ]
Re:The Windows installer of ImageMagick will no longer be si... by brnt on Sunday October 29, 2023 @02:44PM (#38061387)
> Most OS software is downloaded from code repositories like github or fosshub to save on networking costs,

[X] Doubt

Do not underestimate the sheer number of people jamming in software names or descriptions into Google and getting their wares on the likes of softpedia.

[ Parent | on HN ]
Re:The Windows installer of ImageMagick will no longer be si... by nolongerthere on Sunday October 29, 2023 @05:42PM (#38063109)
same difference though, that's the equivalent of a CDN or fosshub. Its definitely not the author of the software.
[ Parent | on HN ]