alt Hacker NewsWhat would be the point? How would you prevent malware from being signed? Currently, code signatures are used as a signal for trustworthiness of the code.
Replies
megous • today at 1:24 PM
Only signal is that whoever is in the subject DN (highly) probably signed the code. There's 0 signal about trustworthiness of the code in the signature. Thrustworthiness signal is in the behavior/reputation of the signer.
Pretty sure there were historically a lot of apps that stole peoples contact lists and were signed properly. Certainly in the Android world.
duskdozer • today at 10:13 AM
Is it some entirely different process than providing hashes and a GPG signature?
➕ show 1 reply
Eldt • today at 9:26 AM
Misplaced trustworthiness?
Microsoft signed the Crowdstrike updates. I don't think a CA signing a piece of malware is a realistic thing to be concerned about.