Hacker News Reader

Comment by Someone1234 | Hacker News Reader

None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not.

Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now.

Let's Encrypt are welcome (when they arrive), but they still don't offer Code Signing, Wildcard Certificates, and so on. The whole certificate/CA industry needs change, Let's Encrypt doesn't go nearly far enough. I blame Microsoft, Mozilla, and Apple primarily as they decide who gets to be a CA, and could allow non-profits and other disruptive startups into the space if they wished.

View on HN

"None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not."

You mean Autenticode on Windows? I once had an Authenticode code signing cert that I used to sign Windows executables. Mostly, I signed hobby projects with it.

I wrote a proof of concept keystroke logger for Windows, then Authenticode signed it and made it available along with source code for others to experiment with and review.

Several years later, some customers of Zemena and Comodo complained that the keystroke detection/security software (that they had paid money for) did not detect my keystroke logging software.

This caused a big fuss. Even though my software had been available for years, was code signed, came with full source code and was clearly labeled for educational purposes only, the security companies sent takedown notices to my ISP, placed my domain on DNS blacklists and 'fixed' the issue by declaring any exe signed by my Authenticode cert as malicious. Their customers were then happy and felt safer as it was now 'detected'.

The real issue was that the security software trusted any code that was Authenticode signed and let it run no matter what. There was a check-box somewhere to disable that, but long story short, I would not say that Authenitcode code signing is a big security benefit today. It may help some, but not much. Maybe in the future.

I still have the Keystroke logger source code: https://github.com/w8rbt/keycap

Someone with an Authenticode cert should compile it and then sign it and see if it still gets by the security vendors.

Signing verifies identity, nothing more. That keylogger was yours. In this case, signing putty tells us that it comes from the putty maintainer. The content, what it actually does, whether its not malware inside, etc doesn't matter.

Putty should be signed, imo.

I was merely suggesting it as a way to verify who created that binary of Putty. Nothing more, nothing less. If you ignore who signed the binary completely, yes, it could be open to abuse.

The "browser" half of the CAB forum is happy to accept new CAs that meet their standards. Non-profits and disruptive startups are finding that difficult, as they should—it's hard to run a CA safely. It's not hard like curing cancer is hard, or even like heart surgery is hard. It's hard like avoiding iatrogenic infection is hard: it requires constant and diligent adherence to rules in the presence of no visible threat.

LE are a wonderful start, and they are succeeding in part because they're moving slowly. I expect them to go further, but only with full understanding of the obligations they take on by doing so. They're very, very right to be conservative in their operational practice, because they'll be allowed no more slack than anybody else, and maybe less.

Could something like LE have started ten years ago? Maybe, but nobody did. CAcert.org was a lovely dream, but didn't (and couldn't) hold to those standards of diligent practice.

The "browser" half of the CAB forum is happy to accept new CAs that meet their standards. Non-profits and disruptive startups are finding that difficult, as they should—it's hard to run a CA safely.

This is something that Google should do.

$73/year is not free but calling it "insanely expensive" is pretty unfair.

While I fully understand where you are coming from let's try and remember that putty is 100% free and I'd bet money the author puts in more time/energy/money than he gets back from it. That means that ANY money spent is more money in the hole making $73/yr ($219 all at once b/c you have to pay for 3 years) quite a bit of money.

I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.

And then some - I don't see a donate link anywhere on putty.org or the linked sites, but who wouldn't donate 5 bucks to putty, when they use it for free basically every day? I've paid 5 bucks for less useful programs.

I remember reading the statement about beer and curry some years ago, so I knew there was a link somewhere: http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#f...

Or "paid version is signed, free version is not."

No doubt but we all need to remember that sometimes accepting money is more trouble than it's worth. I know that sounds crazy but people taking donations have to declare that on their taxes and some people don't want to deal with that. Also while crowdfunding platforms have gotten really easy they still take effort and sometimes some sort of verification process. It's obvious the putty dev is not a designer (I don't say that to be mean) so I'm sure there would be people here on HN that would be all like "Ugh, this guy is asking for money and he can't take 2 minutes to make his funding site look halfway decent???" (Those people would be clarified as douches but that wouldn't stop them from making the comment nor the dev potentially reading them).

Lastly let's say he gets the money and takes care of the taxes and all of that. Now he has to get a code signing cert (not a fast or easy process I would assume) and add that to the list of things he needs to do for each release. We are talking about a non-trivial amount of work over a month or more all so that people will stop bitching about the FREE and OPEN SOURCE product he is producing...

If you find code signing/HTTPS to be so important I suggest you do it yourself, the code is freely available and since it's under an MIT licence you can even SELL access to your code-signed and https-protected putty version. I'm not saying that either of these things are not important (they both are) but let's not jump down the dev's throat because they aren't giving up even more of their time on something they seen no return on.

I certainly don't mean to jump down the dev's throat -- I have been using Putty for years (without, I must admit, a second thought about whether the binary might be compromised) with nothing but gratitude. And I don't think anyone else should direct their complaints at the dev either. My comments are addressed to those who complain, in a general way, that it is not easy enough for a developer to write trusted code.

Putty seeks to perform a security-critical function. It may simply not be realistic to expect that someone can simply step into the market and provide such a tool safely, without putting some effort into building trust with users through, e.g., a code signing certificate. That, after all, is one of the reasons why trust works--it is non-trivial to build.

Again, I don't blame a developer for not doing these things, and I am all for helping developers jump through the hoops they need to jump through, if they are willing.

I understand what you are saying about "Putty seeks to perform a security-critical function." and therefore it should take these things into account (in a perfect world). I don't speak for all developers, obviously, but I'd wager a guess that most developers don't code (for OS at least) to "corner the market" or essentially become and run a mini-corporation (Twitter, Blog, Github, HTTPS, Code Signing, Website w/ Landing page, etc). They do it to scratch their own itch or to help someone else scratch theirs. Once they finish they upload it to github or some code-hosting platform as way to share the work they've done and contribute back into the community. TBH we are lucky they do even that. To ask them to provide and maintain extra processes just seems a little wrong. I get that code-signing and HTTPS ARE important and probably needed for a tool like this but I think the question we should be asking is "How can we help get to that point?" and not "Why hasn't the developer done this already?!?!". The fact that the developer continues to update/bug fix this program is amazing (as recently as "2015-02-28") and I worry about driving off a developer/contributor just because they didn't do a few things that probably don't interest them at all.

I say all of that less towards you and more generally in the context of this thread as you did point out "I am all for helping developers jump through the hoops they need to jump through, if they are willing".

Sounds like we're in agreement.

But what can we do? I don't think it's realistic to expect anyone to issue code-signing certs for free. Any credible process for issuing the certs, it seems to me, would be too resource intensive for anyone but a charity to do for free.

For projects like Putty it probably won't be a problem to raise money for the cert, if the dev wants to go that route. But I don't know what's to be done about the dev who, understandably, just isn't interested in dealing with all that entails, or projects with smaller followings than Putty.

Do we need to start some sort of organization to help hobbyist and independent devs with this problem? Even if there were a group of people willing to take this on, (I might be), would it be a good idea? Taking on the responsibility of verifying a dev's identity and helping him or her with things like code signing certificates seems like a liability nightmare, for one thing.

I think joshstrange has it right: the easiest way for everyone is to do it yourself and take the original developer out of the loop. There's no reason the person who writes the code and the person who handles the certified distribution need to be the same. Set up a site 'pdabbadabba's signed distribution of putty (and perhaps of whatever other open source programs you think merit such),' get the certificate yourself, offer downloads and ask users for money to cover the costs.

A fair point, and I'm actually tempted to do just that. I wonder, though: why on earth would anyone trust code that I have signed? At least the developer has (maybe) built some level of trust. But what's the benefit of signing by some random third party?

Trust is built by things like time and social proof. Whether you're the person who wrote the code doesn't really come into it. Look at how it works on Linux: most people install most software via package managers. Nobody expects the person who wrote the code to be the same as the person who has the knowledge and resources to package stuff for Debian or whatever. The Debian packagers have earned trust over time. You could do the same thing.

This is fine, but for anyone to be able to actually trust that this person's signed distribution of some piece software is actually safe then you would have to assume that the person has some way of obtaining the source code from a place that they themselves trust. If they don't write the code and have no access to any other signed version this may be difficult.

Linux packagers seem to have successfully solved this problem. I imagine it's at least in part because it makes sense for them to put in a bit more effort (e.g. email to the author to make sure they have the right version, if necessary) to save every user having to redo it.

I think cash gifts are tax-free in the UK, with the possible exception of large sums given shortly before someone dies (which would become subject to inheritance tax).

The FAQ gives an address for Paypal donations / beer money: http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#f...

Oh, FFS, I write a free terminal emulator with a fraction of the users of PuTTY, I pay $100/year to sign it, and O($100)/year in hosting + CA fees. Donations cover it easily.

That may be true, but it's so little that I'm sure he could find thousands of people/companies that would be happy to sponsor this. Including me.

There's a non-trivial paperwork requirement too. I'd have no problem paying and getting a cert from the comfort of your chair like you can do with SSL. However for code signing I have to take time out of the day to visit a notary public to verify my identity as part of the process. This is likely also going to cost additional money.

Open source developers have a dwindling number of free options:

http://stackoverflow.com/questions/1177552/code-signing-cert...

https://reactos.org/wiki/Driver_Signing

TIL: $73/year is "insanely expensive".

Literally cheaper than sponsoring an African child or paying Sarah McLachlan to stop using commercials to make me cry.

Would you mind paying for a code signing and two wildcard certificates for me then, please? Yearly, of course.

I would cover the costs out of my profits, but the $0.00/yr I am pulling in from my open source projects doesn't quite cover it, let alone the $200/yr for the VPS and domain registration.

What are you adding to his productivity? I'd pay it if you were as useful as putty.

Without relaxation, it's very hard to be productive (byuu develops Nintendo emulators).

If SSL is free and easy (especially if it's automatable) to generate through Let's Encrypt, the use case for wildcards mostly goes away.

> When Let’s Encrypt launches in mid-2015, enabling HTTPS for your site will be as easy as installing a small piece of certificate management software on the server:

"When" being the keyword. Also they don't, as of this post, do code signing...

Excuse me for being a pedant, but wouldn't Let's Encrypt end up being just another potential attack surface?

No more than the existing for-pay SSL providers, I'd imagine. What sort of attacks are you proposing?

With code signing there remains the problem that how do I figure out who to trust. I don't remember the exact details for the author of PuTTY.

Reply on news.ycombinator.com