Hacker News Reader

Comment by pornel | Hacker News Reader

That's me!

I was incredibly salty about this. I didn't name the CA, because they're actually nice to have reduced price for Open Source projects, but Microsoft really needs to drag the whole process into the 21st century.

The process and infrastructure reminds me very much of TLS before Let's Encrypt. If this is something that every developer needs to do for every exe, it can't be like getting an EV certificate for a Netscape Server. I thought Apple's often-buggy signing was bad, but at least they've tried to make it a one checkbox paid for in a straightforward transaction.

I would have signed with SHA-2, which for inexplicable reason is not the default despite deprecation, but my signtool crashed when I enabled it.

View on HN

That CA took you for a ride. My open source Windows projects are signed, too. No smart card, no PIN when signing, no special software. I did have to provide some identity information and a photo, but identity verification is the service that CAs are expected to perform here. You would have had a better time with a different CA.

There have been recent changes in Microsoft's policy which now require a physical device to be used for signing. It's a giant pain. They alluded to cloud based services for signing, but other than Symantec's Enterprise offering (no listed price on their site), this doesn't really exist. I think MS needs to step up and provide a simple cloud based signing service. They should have waited to do this before forcing these changes.

That's not correct. Smart cards are required only by EV Code Signing certs. This is not it, this is regular code signing cert. And there is no reason to panic. While the author sees warnings now it's because the cert is fresh, it will gain reputation over time and be trustworthy.

Just remember to timestamp while you sign!

Everything I've read hasn't differentiated. I can't seem to track down the official MS policy on my phone. Our certs are EV (need to sign drivers), so my experience is limited to EV certs.

My latest signing certs were issued around last August, and there didn't seem to be any extra rigmarole to get them (although I work for a large corporation; maybe that makes a difference?).

We've basically got a giant keystore server that handles the secret keys for all of the company's signing, then signing provider plugins installed on the build machines to communicate with the keystore, while allowing us to use standard tools like signtool.

Interesting, I just read up on that. Thanks for the info. My code signing certificate was issued before the cutoff, which appears to have been February 1, 2017. I guess I'm in for some fun when I need to renew.

Who is a good CA to use?

Open source developer here. Also used to get Certum certificates with reduced price for open source developers, but their smartcard junk convinced me to use another provider. And they also raised their pricing policy.

I ended up with Comodo, which was "cheap". I then discovered that this was cheap for a reason: they did not provide the identity validation (something which was not clearly stated anywhere), and I had to pay for a notary certification (which was about twice as much as the certificate price), because apparently in the US an ID card is considered as reliable as your sport club membership card.

The whole Microsoft code certification is a shit show. It provides no security whatsoever, feeds an incredible number of incompetent parasites, and at the end is a real burden for open source developers like me, who want to get rid of the nasty Windows security messages, but also want to avoid being targeted by download sites bundling your binaries with some adware crap.

A "let's encrypt for code" ? Please sign-me up!

signtool badly needs to be updated. The interface is very confusing and the documentation, while fairly complete, isn't very helpful.

That said, I just upgraded ours and didn't have much trouble switching to sha256. There is one quirk about the order of the arguments due to some limitation with the timestamping servers. The documentation loudly points this out though. If it helps, here's my exact command line:

    signtool.exe
        sign /v
        /n "Company, LLC"
        /ph /d "Description"
        /du "https://www.website.com"
        /tr "http://timestamp.comodoca.com"
        /td sha256 # /td must come after /tr
        /fd sha256
        executable.exe

Not being able to automate these EV hardware tokens because of the password is a pain that I'm already annoyed by though.

Pretty sure the new way is via PowerShell: Set-AuthenticodeSignature -HashAlgorithm "sha256" -IncludeChain "all" -FilePath "File" -Certificate $Cert -TimestampServer $TSUrl

Can you confirm that the reason the password is forced is the PKCS12 (pfx) import has flagged the key as requiring a password every signature? (and it cannot be disabled).

I believe you can use mimikatz to forcibly strip the strong protection flag from the key. Microsoft says this is normally not possible, yet here we are. You might want to try downgrading the strong protection flag on the key material, it may allow for automated signing.

> # /td must come after /tr

Confirmed HTML

But... it's </td></tr> in HTML. :-P

I've ran into similar frustration getting an exe certificate.

In one example, the provider needed to check I was a legitimate business, by seeing if I was in the phone book -- so I just registered online, called them back, they saw it and granted me the certificate, then I unregistered.

Waste of time.

Which signtool did you use? (You may have more than one on your system. This has cost me more time than I would like to admit. I'd make sure you're using the one from the latest Win 10 SDK.)

I did find four! Yes, I've picked one at random. None of them was in my path, even after running vcvars*bat. Given Conway's law, I suspect signtool has a different project manager than the VS team.

Interesting, what command did you use? This works for us without any issues:

signtool sign /a /fd SHA256 /tr "http://timestamp.globalsign.com/?signature=sha2" /td SHA256 <exefile>

I've copied that exact command from 3rd party documentation. Microsoft didn't even bother to give a SHA-2 example in theirs.

And maybe I'm spoiled, but could it not require four switches of a "don't do useless thing" kind? It's as if `copy` required /ones /zeros switches to be explicit you don't want it to omit these bits.

It's a safety issue though. Only experts should run `copy /ones /zeros`, because if you get too many ones on one side and zeros on the other it can throw off your hard disk's alignment and void your warranty.

Sorry to go off topic, but I'm wondering what's the goal of the tool as there are already ways of doing this. I've created a bat file that uses youtube-dl to download a video and convert it to gif using several tools and parameters (ffmpeg, imagemagick). I use it to make inline posts on hangouts since it's 2018 and I need a mobile device to post inline videos there for some reason.

Anyway, your tool seem to get good image size on videos with lots of colors, but horrible size on simpler images. Using the --fast switch as it took 6 minutes to convert 387 frames to save 10% on filesize. I'm comparing it to ffmpeg with a pallete as it seems to get similar image quality with a smaller size in most cases.

Gist of my bat file. https://gist.github.com/Nodja/8ece6c3d866867877442e34bf67ece...

edit: After reading this after posting it, it looks as I'm super critical/aggressive. I'm just genuinely curious at what drove you to write the tool as there are already ways to achieve what you wanted. Didn't mean to antagonize you.

If you want headless automated builds, I recommend trying Sikuli on top of a VM. It doesn't require any toolkit/OS support to automate your applications.

It is disgustingly easy to set it up, it is software none of us deserve.

http://www.sikuli.org/

Oh man, Sikuli (and SikuliX http://sikulix.com/) is amazing. It's the kind of thing where I hate that it has to exist, but I'm so happy that it does exist.

Reply on news.ycombinator.com