Talk:Code signing

Untitled

 * What exactly is wrong with this article? Why is it being considered for deletion?  If anything, what it lacks is content, but I believe it's a legitimate topic for an article.  Will add some content.Marcos Juárez 19:13, 20 February 2006 (UTC)


 * I wanted to add a note that average user is likely to trust a large software company, but that creates a problem since a disgruntled employee inside such a company could potentially insert malicious code. In other words, the way it's presented, code signing is likely to appear as a panacea to the average user, but will definitely not be one. Doesn't sound very encyclopedic, though, so I leave it to the rest of you. - feel free to write it in if you can phrase it better. Fry-kun (talk) 10:04, 8 March 2008 (UTC)


 * Someone may want to add under Problems that if the system used to develop the software is infected by a computer virus it may be possible (depending on many factors) for the virus to infect the software prior to its being signed, in which case the code as signed is not safe even though it is signed by a well-intending developer. 99.244.184.166 (talk) 05:49, 17 July 2009 (UTC)


 * This article probably should include a reference to Certificate Revocation Lists (CRLs)


 * There is public confusion about correctly signed code with a certificate that has expired (code was signed before expiration.) People incorrectly interpret this as a breach/violation of the certificate. —Preceding unsigned comment added by 12.155.58.181 (talk) 18:31, 8 December 2010 (UTC)

In-complete question.
One thing I did not find in this article: is it possible to digitally sign self-modifying program code?

The IBM compatible PC is a modified von Neumann architecture, where stored data can become program instruction, therefore self-modifying code is perfectly legal and is NOT the exclusive domain of malware (viruses).

For example, really expensive commercial software may use self-modifying code together with a hardware dongle device to strongly protect against unathorized duplicate use. Such software vendors may wish to have their programs signed digitally for trustedness, since anti-virus programs have a tendency to heuristically alert on almost any self-modifying code, be it a virus or a false alarm on legitimate program code. One method to prevent such occurances is that many AV software automatically exclude trusted-signed binaries from virus checking. 82.131.210.163 (talk) 17:25, 24 April 2012 (UTC)

Code Signing on macOS
Code signing on macOS can easily be defeated as the executable section in question can be stripped.

code signing on Linux
Our article says "This form of code signing is not used on Linux", but should say that at least some Linux distros (one I'm sure of is Debian) do support digital-signature-based validation of the packages they install. —Steve Summit (talk) 16:35, 9 June 2016 (UTC)

External links modified (January 2018)
Hello fellow Wikipedians,

I have just modified one external link on Code signing. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
 * Added archive https://web.archive.org/web/20140409005555/http://www.cryptnet.net/fdp/crypto/strong_distro.html to http://www.cryptnet.net/fdp/crypto/strong_distro.html

When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.

Cheers.— InternetArchiveBot  (Report bug) 13:36, 19 January 2018 (UTC)

How is signing before the expiry enforced?
One question that isn't really addressed in the article is how the signature on a program is verified to have been made before the expiry of said signature. Mjmouse (talk) 14:36, 9 October 2022 (UTC)