• korstmos@kbin.social
    link
    fedilink
    arrow-up
    160
    arrow-down
    2
    ·
    1 year ago

    Because paying a few grand a year for a certificate somehow makes your software more trustworthy

    • RippleEffect@lemmy.world
      link
      fedilink
      arrow-up
      22
      arrow-down
      2
      ·
      1 year ago

      Well it at least is an obstacle. Broke hackers won’t get it or will have to work harder to get around it.

      • Ddhuud@lemmy.world
        link
        fedilink
        arrow-up
        41
        ·
        1 year ago

        That’s the intention. In reality lots of genuine devs can’t afford it, so people get accustomed to just ignore the whole thing.

    • ryannathans@lemmy.fmhy.net
      link
      fedilink
      arrow-up
      10
      ·
      1 year ago

      Even more lols when you are gigabyte and your private key leaks. Also when you are gigabyte and your signed driver is used to privilege escalate malware.

    • smolyeet@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      3
      ·
      1 year ago

      And that’s why certificates can be revoked, that’s the whole point, trust. It only costs a few hundred a year per Microsoft’s documentation and approved vendors so it doesn’t seem that much of an ask. At the very least you can look up the developer yourself, harder to do if the package has no identity associated with it