Programmer's Haven
« Code Signing For Small Software Developers »

Welcome Guest. Please Login or Register.
Dec 27, 2009, 11:56am

[Home] [Help] [Search] [Login] [Register]



Programmer's Haven :: General :: Articles & Software Reviews :: Code Signing For Small Software Developers
   [Search This Thread][Send Topic To Friend] [Print]
AuthorTopic: Code Signing For Small Software Developers (Read 71 times)
Michael
Uber Yapper
*****
member is offline

[avatar]


[homepage]

Joined: Oct 2007
Gender: Male
Posts: 974
Code Signing For Small Software Developers
« Thread Started on Nov 4, 2009, 2:46pm »
'With the coming of the information age, communication with others has never been easier. Likewise, the capacity for mis-information has kept pace lockstep. When you distribute data electronically, you may find that there are times when others wish to authenticate data as truly being offered by the stated individual(s). Not an unreasonable request...'

http://topcat.hypermart.net/codesigning.html

Link to Post - Back to Top  IP: Logged
Link Mojo: A Link Exchange For Small Software Developers
Garrett
Administrator
member is offline

[avatar]

I shall conquor the worl..... Ooooo, pretty blinking LED lights!


[homepage]

Joined: Dec 2006
Gender: Male
Posts: 623
Location: In my mind
Re: Code Signing For Small Software Developers
« Reply #1 on Nov 4, 2009, 4:22pm »
So, is this something like Verisign? So that Windows won't nag about it being possibly a threat?
Link to Post - Back to Top  IP: Logged
'What you do not want done to yourself, do not do to others.' - Confucius (550 b.c. to 479 b.c.)

Some software and links: [Parabolic Logic]
My blog, or, My Rants: [MSN Live Spaces]
Jerry Muelver
Retired Admin
member is offline

[avatar]

Any questions?


[homepage]

Joined: Dec 2006
Gender: Male
Posts: 721
Location: Northwoods Wisconsin
Re: Code Signing For Small Software Developers
« Reply #2 on Nov 4, 2009, 8:08pm »
For small software developers? I don't qualify. I'm 6'4", 215 lbs....
Link to Post - Back to Top  IP: Logged
"Wiki" is the answer. What was the question, again?
North American Ido Society home page
Tweets at http://twitter.com/jmuelver
Michael
Uber Yapper
*****
member is offline

[avatar]


[homepage]

Joined: Oct 2007
Gender: Male
Posts: 974
Re: Code Signing For Small Software Developers
« Reply #3 on Nov 4, 2009, 8:09pm »
Close, but subtly different Garrett... Here's what I know:

The method I outline (100% free) works by a mechanism known as a 'web of trust':

http://en.wikipedia.org/wiki/Web_of_trust

Verisign uses a method known as 'CA' (certificate authority) and is out of reach cost-wise for most of us for all practical purposes:

http://en.wikipedia.org/wiki/Certificate_authority

And yet another type of validation just in case... is TLS (formally SSL) that's both free and commercially available :

http://en.wikipedia.org/wiki/Transport_Layer_Security

btw... I revised the article you read to help clear that up (thanks for the heads up!)
« Last Edit: Nov 4, 2009, 8:15pm by Michael »Link to Post - Back to Top  IP: Logged
Link Mojo: A Link Exchange For Small Software Developers
Michael
Uber Yapper
*****
member is offline

[avatar]


[homepage]

Joined: Oct 2007
Gender: Male
Posts: 974
Re: Code Signing For Small Software Developers
« Reply #4 on Nov 4, 2009, 8:12pm »
> For small software developers? I don't qualify. I'm 6'4", 215 lbs....

Chuckle, ya know I almost made a footnote on that very topic...

'Elven coders unite!'

What's a better term?
Link to Post - Back to Top  IP: Logged
Link Mojo: A Link Exchange For Small Software Developers
Garrett
Administrator
member is offline

[avatar]

I shall conquor the worl..... Ooooo, pretty blinking LED lights!


[homepage]

Joined: Dec 2006
Gender: Male
Posts: 623
Location: In my mind
Re: Code Signing For Small Software Developers
« Reply #5 on Nov 4, 2009, 10:45pm »
Check your spelling on your article Michael, I see one spelling error right off.... "It solely confirms the data has not been tapered with" should be "It solely confirms the data has not been tampered with".
Link to Post - Back to Top  IP: Logged
'What you do not want done to yourself, do not do to others.' - Confucius (550 b.c. to 479 b.c.)

Some software and links: [Parabolic Logic]
My blog, or, My Rants: [MSN Live Spaces]
Garrett
Administrator
member is offline

[avatar]

I shall conquor the worl..... Ooooo, pretty blinking LED lights!


[homepage]

Joined: Dec 2006
Gender: Male
Posts: 623
Location: In my mind
Re: Code Signing For Small Software Developers
« Reply #6 on Nov 4, 2009, 10:51pm »
Ok, so this sounds like something that some of us might want to get together over. As I read it, it helps if several holders of keys endorse each other. Did I read that right?
Link to Post - Back to Top  IP: Logged
'What you do not want done to yourself, do not do to others.' - Confucius (550 b.c. to 479 b.c.)

Some software and links: [Parabolic Logic]
My blog, or, My Rants: [MSN Live Spaces]
Michael
Uber Yapper
*****
member is offline

[avatar]


[homepage]

Joined: Oct 2007
Gender: Male
Posts: 974
Re: Code Signing For Small Software Developers
« Reply #7 on Nov 5, 2009, 9:09am »
Yep, Garrett just let me know if you need someone to sign your key, & I'll add you to my keyring. I've got two keys on my ring now (part of the reason I wrote this was to help me recall all the details...) And make no mistake about it... there are projects that only allow signed code in the door from the get-go like Apache.

I want to point that, codesigning in this manner will not prevent IE from throwing up a message about your downloads being 'unknown'. So far, only a handful of CA's are 'hardcoded' into Windows browsers. CA's are automatic though, where a WOT is manual out of the box (but can be automated with scripts). I simply can't justify the cost (200-500 USD!)

Now while I've always defended closed-source (its either free, or its not, no biggie to me), this is one area I'm squarely on the open source side of things... With CA's, the only bar is money... there is no trust involved, if you can pay you're in. With PGP, & GPG, your trust rating is just like your credit rating, in other words you can grade a key on your ring as trusted, sorta trusted, no faith in a key at all... You cant do that with a CA, the CA is the -sole deciding party-...

2ndly in a WOT, its decentralized, if a CA is sold to another party, or unavailable, you cant validate a certificate. With the open way, if I cant validate your key, I could always go through (say Jer) to do it. Its just a better way in my thinking, makes more sense.

Okay, updated the article for the spelling error, & added a thought or two... thanks.
« Last Edit: Nov 5, 2009, 9:12am by Michael »Link to Post - Back to Top  IP: Logged
Link Mojo: A Link Exchange For Small Software Developers
Jerry Muelver
Retired Admin
member is offline

[avatar]

Any questions?


[homepage]

Joined: Dec 2006
Gender: Male
Posts: 721
Location: Northwoods Wisconsin
Re: Code Signing For Small Software Developers
« Reply #8 on Nov 5, 2009, 9:21am »
I'm reading "Wikinomics" by Tapscot and Williams. Subtitle is "How Mass Collaboration Changes Everything."

This code-signing notion is SO Web.3.0! Great idea! ;D
Link to Post - Back to Top  IP: Logged
"Wiki" is the answer. What was the question, again?
North American Ido Society home page
Tweets at http://twitter.com/jmuelver
Michael
Uber Yapper
*****
member is offline

[avatar]


[homepage]

Joined: Oct 2007
Gender: Male
Posts: 974
Re: Code Signing For Small Software Developers
« Reply #9 on Nov 5, 2009, 9:26am »
Hey that sounds nifty... I'll google it.
Link to Post - Back to Top  IP: Logged
Link Mojo: A Link Exchange For Small Software Developers
Michael
Uber Yapper
*****
member is offline

[avatar]


[homepage]

Joined: Oct 2007
Gender: Male
Posts: 974
Re: Code Signing For Small Software Developers
« Reply #10 on Nov 5, 2009, 8:03pm »
Idea marketplaces... now that's cool, I'm going to order this pup.
Link to Post - Back to Top  IP: Logged
Link Mojo: A Link Exchange For Small Software Developers
   [Search This Thread][Send Topic To Friend] [Print]

Google
Webcodecraft.proboards.com
Click Here To Make This Board Ad-Free


This Board Hosted For FREE By ProBoards
Get Your Own Free Message Boards & Free Forums!