Hacker News Reader

Comment by rand846633 | Hacker News Reader

It’s also not clear why the IM project should be paying MS and not the other way round…

Yeah, I mean people should definitely be paying ImageMagick. Or perhaps it's more true to say, "ImageMagick should definitely figure out a way to become a business."

MS does not sell certificates.

It's the one mandating them and not offering acceptable alternatives.

they do offer an alternative, Azure Code Signing (ie cloud HSM). ImageMagick are looking at moving to it. it's free but someone difficult to access, due to the identity verification requirements

The cartel leaders don't sell drugs, street pushers do.

MS just have to sell licenses to sell certificates.

But that's a thin line. Free certificates negate security.

Instead, there are various foundations that sponsor popular open source projects for costs like signing certificates and hosting. I'm sure one of these should be trustworthy enough to obtain a signing certificate themselves so they can issue and revoke certs to various projects without much cost.

This does not solve the problem at all, and does not improve security either. Microsoft themselves could perfectly well have the same analysis in-house and provide free certificates to properly vetted projects. Adding layers of middlemen to deal with is a pain in the backside and a consequence is that some projects will just not bother. It’s inefficient on all levels and still does not protect from bad actors.

They practically do. Distribute via the MS Store and they'll sign your software using Microsoft keys, and it costs you $19 once. It's the best way for ImageMagick to resolve their cost issue.

Look at it this way, why should a project like IM pay MicroSoft for the privilege of enriching and adding value to the Windows platform?

The fee for code signing certificates doesn't go to Microsoft.

Who actually receives the money is not relevant to my core point.

If it’s not relevant to your point, can you make your point without stating something that is false?

"Look at it this way, why should a project like IM pay anyone for the privilege of enriching and adding value to the Windows platform?"

They aren’t adding value to the Windows platform, unless you consider any application is adding value to the platform it is running on. In which case why should one pay for dev tools, their dev computer, libraries, art assets, etc…

Because Ms hasn't asked for it.

Of course MS asked for it. They created and sustain this situation where software needs to signed for it to easily run on the Windows platform. Who do you think put the signature checking code and root keys in Windows?? The code signing gnomes?? fairies??

Seems more like the work of gremlins or devils. ;)

They didn't ask for ImageMagick. Would they have asked ImageMagick to develop the software for their platform to enrich it, I would have agreed that they should pay. Otherwise anyone can say I enrich your ecosystem so pay me.

Reply on news.ycombinator.com