Talk:Code signing

Untitled

• What exactly is wrong with this article? Why is it being considered for deletion? If anything, what it lacks is content, but I believe it's a legitimate topic for an article. Will add some content.Marcos Juárez 19:13, 20 February 2006 (UTC)

• I wanted to add a note that average user is likely to trust a large software company, but that creates a problem since a disgruntled employee inside such a company could potentially insert malicious code. In other words, the way it's presented, code signing is likely to appear as a panacea to the average user, but will definitely not be one. Doesn't sound very encyclopedic, though, so I leave it to the rest of you. - feel free to write it in if you can phrase it better. Fry-kun (talk) 10:04, 8 March 2008 (UTC)

• Someone may want to add under Problems that if the system used to develop the software is infected by a computer virus it may be possible (depending on many factors) for the virus to infect the software prior to its being signed, in which case the code as signed is not safe even though it is signed by a well-intending developer. 99.244.184.166 (talk) 05:49, 17 July 2009 (UTC)

• This article probably should include a reference to Certificate Revocation Lists (CRLs)

• There is public confusion about correctly signed code with a certificate that has expired (code was signed before expiration.) People incorrectly interpret this as a breach/violation of the certificate. —Preceding unsigned comment added by 12.155.58.181 (talk) 18:31, 8 December 2010 (UTC)

In-complete question.

One thing I did not find in this article: is it possible to digitally sign self-modifying program code?

The IBM compatible PC is a modified von Neumann architecture, where stored data can become program instruction, therefore self-modifying code is perfectly legal and is NOT the exclusive domain of malware (viruses).

For example, really expensive commercial software may use self-modifying code together with a hardware dongle device to strongly protect against unathorized duplicate use. Such software vendors may wish to have their programs signed digitally for trustedness, since anti-virus programs have a tendency to heuristically alert on almost any self-modifying code, be it a virus or a false alarm on legitimate program code. One method to prevent such occurances is that many AV software automatically exclude trusted-signed binaries from virus checking. 82.131.210.163 (talk) 17:25, 24 April 2012 (UTC)

Code Signing on macOS

Code signing on macOS can easily be defeated as the executable section in question can be stripped.

code signing on Linux

Our article says "This form of code signing is not used on Linux", but should say that at least some Linux distros (one I'm sure of is Debian) do support digital-signature-based validation of the packages they install. —Steve Summit (talk) 16:35, 9 June 2016 (UTC)

External links modified (January 2018)

Hello fellow Wikipedians,

I have just modified one external link on Code signing. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:

• Added archive https://web.archive.org/web/20140409005555/http://www.cryptnet.net/fdp/crypto/strong_distro.html to http://www.cryptnet.net/fdp/crypto/strong_distro.html

When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.

This message was posted before February 2018. After February 2018, "External links modified" talk page sections are no longer generated or monitored by InternetArchiveBot. No special action is required regarding these talk page notices, other than regular verification using the archive tool instructions below. Editors have permission to delete these "External links modified" talk page sections if they want to de-clutter talk pages, but see the RfC before doing mass systematic removals. This message is updated dynamically through the template {{source check}} (last update: 18 January 2022).

• If you have discovered URLs which were erroneously considered dead by the bot, you can report them with this tool.
• If you found an error with any archives or the URLs themselves, you can fix them with this tool.

Cheers.—InternetArchiveBot (Report bug) 13:36, 19 January 2018 (UTC)

How is signing before the expiry enforced?

One question that isn't really addressed in the article is how the signature on a program is verified to have been made before the expiry of said signature. Mjmouse (talk) 14:36, 9 October 2022 (UTC)