More on Sunburst: what can we do to prevent this kind of supply chain attacks in the future? https://t.co/qrB0R30VFW
Reviews, secure build chains... and SignPath, maybe, to make sure reviews and security are in place before code signing.
Connecting build systems to HSMs is not enough, nor are specialized HSM proxies dressed up as code signing solutions. We need policy management & enforcement, airtight & verifiable integration from source code to build to signing. That's what we do. 4/4
Most in-depth SunBurst analysis we've seen so far: https://t.co/4xvEfk4wDz
Build systems and code singing are primary targets for suply chain attacks, allowing hackers to "evade millions of dollars of security investment" at their eventual targets. 1/4
While SignPath can help with driver cross-signing, attestation *and* HLK signing, customers express concern about consequences of Microsoft dropping cross-signing for good https://t.co/rqvA5Ddf3N via @OSRDrivers /cc @vcsjones@clairernovotny
@sforkmann@matkoch87@buhakmeh@PaketManager Our if you find another cert sponsor, they can provide the cert through a free OSS SignPath subscription. It's then up to them to define policy, they'll be in charge of the cert anyway. After all, certs are less about the cost than the name you put on it.
@sforkmann@matkoch87@buhakmeh@PaketManager Yes, for automatic build+release you'd have to split your build script: 1. build unsigned artifact and submit for signing, 2. upload for release (can be triggered by Webhook). That's what we need to automatically verify each build.
@natemcmaster@nuget Problem: policy mgmt is designed for enterprises, but b/c of huge share of @nuget projects, requires OSS prj buy-in. https://t.co/TmP4cTePOM aims to turn this around by offering real trust to OSS: signature connects the binary to the source repo, not just sbdy's reputation.
@clairernovotny@minter@shanselman Many thanks @clairnovotny! @minter: https://t.co/u34rNgiMUj is even a bit cheaper for multi-year certs + you don't get the mess that comes with reseller accounts. You might need an EV cert though: https://t.co/6J9bLR4pJU. No dongles when using https://t.co/TmP4cTePOM
@onovotny@vcsjones@IgorRussKie@migueldeicaza Association with Azure AD seems to be the most they do. No legal ID vetting afaik. (Know how they identify device driver publisher identities for portal signing via AAD? Make them show EV cert.) Even if they did, solution for OSS still required.
@onovotny@vcsjones@IgorRussKie@migueldeicaza Not on the level they require from CAs afaik, but could be wrong. Dev from my org had no trouble publishing in our name, verification never happened.