[DougN7]

Besides paying money you also go through a (pretty simplistic) audit. It’s about the only way we have to know who published some code, which is important. If you can come up with a better way you should implement it and we’ll all follow.

As a side note, I’ve been trying to figure out how to get an EV code signing cert that isn’t tied to me (want to make a tool Microsoft won’t like and don’t want retaliation to hurt my business) but I haven’t come up with a way to do it - which is a good thing I suppose.

[hunter2_]

Can you have someone else go through the process of getting it, like a Craigslist rando to whom you pay cash?

[wongarsu]

If said Craigslist rando likes getting police visits and potentially being criminally liable for helping you commit a felony ...

All code signing promises to give you the name of a real person or company that signed the binary. From there it's the end user's responsibility to decide if they trust that entity.

In practice the threat of the justice system makes any signed executable unlikely to be malicious. But that doesn't mean you have to uncritically trust a binary signed by Joe Hobo

[newzisforsukas]

> In practice the threat of the justice system makes any signed executable unlikely to be malicious.

What threats are those? Where are all the people going to jail for falsely signed software? The stuxnet authors seem to be in the wind.

[wongarsu]

The threat is that if you sign malware with your name you will be quickly connected with said malware. If you don't live in a country that turns a blind eye to cyber crime that is a quick ticket to jail.

Of course people stealing other people's signing keys is an issue. But EV code signing certificates are pretty well protected (requiring either a hardware dongle or 2FA). It's not impossible for a highly sophisticated attacker, but it's a pretty high bar.