Why is that a way bigger problem? Windows will happily run unsigned binaries. Co...

sippingabonedry · 2026-10-20T19:01:48 1792522908

> Windows will happily run unsigned binaries

This is absolutely false, it's a simple policy change to enforce code signing, any organization that is serious about security can do it.

I'll give you the benefit of the doubt and assume you're another Linux guy who doesn't understand Windows security.

The concern of course is with malware being signed, which is far more likely to be abused than some TLS MITM fantasy.

tsimionescu · 2026-10-20T19:43:48 1792525428

Plenty of major programs are not signed, and thus plenty of organizations don't enforce code signing.

sippingabonedry · 2026-10-20T19:47:38 1792525658

For the exceptions, you can sign your own using internal CA.

drdexebtjl · 2026-10-20T23:04:55 1792537495

And keep signing it with every release. No thanks.

throwaway7356 · 2026-10-20T19:12:20 1792523540

> The concern of course is with malware being signed, which is far more likely to be abused than some TLS MITM fantasy.

You already need compromised systems to install malware, signed or not. Not a real problem.

For TLS MitM you just need to use a shared network, wired or wireless.

uep · 2026-10-21T06:59:32 1792565972

> You already need compromised systems to install malware, signed or not. Not a real problem.

Is this true? Ads pointing to a malicious Notepad++ is already an existing thing. Now their malicious version will pass signing checks. Users will happily install these without the system itself being compromised.

kccqzy · 2026-10-21T00:04:57 1792541097

Organizations that are serious about security should have a whitelist of binaries that can run on their computers. Enforcing code signing isn’t good enough.