Hacker News Reader

> Each user compiling a binary is a lot of waste

It's not "waste" if it's needed to establish trust.

> A few years back at my work we were digitally sign our binaries,

Just publishing hashes for the (reproducible) unsigned binaries over a secure channel (such as HTTPS as verified by Let's Encrypt) will give you the exact same security. Digital signatures embedded in executables add no security whatsoever, and make reproducibility harder. Just don't do it.

View on HN

I think it is technically possible to sign a binary and have reproducebility for the people who care, you might need a different binary/package then the current ones but it is technically possible.

We had to sign our applications to prevent scary warnings to appear and then we would have to train our users to ignore that.

The worst part is that a malicious signed binary could just download the malicious parts afterwards. Signing isn't really an answer for google.

Reply on news.ycombinator.com