I'm all for signing releases with private GPG keys+providing SHAsums. The .asc files would be for those who know how to use them (GPG4win+Kleopatra work fairly well) and the SHA[whatever]sum would be the same, but provide a slightly easier process (checksum utilities are widely available and extremely easy to use). All this is free, and as trustworthy as the keysigner and/or the hosting server. Hashing/generating .asc takes only a few seconds.
This still does not prevent someone building and repackaging, but would lend a layer of security and authenticity. Legal avenues are probably the only way to stop someone from improperly distributing FOSS. Also, these clones/ripoffs are all over eBay, always have been. I always get upset when I see them and have in the past written to eBay about them, but eBay did nothing. ~RAWRR On Sat, 13 Sep 2014 06:37:38 +0200 "Sean M. Pappalardo - D.J. Pegasus" <spappala...@mixxx.org> wrote: >Holy crap, Garth is alive too?? How are you, man? > >On 09/12/2014 01:19 PM, Garth Dahlstrom wrote: >> There was a case of this a few years back with some similar >installer >> crap website (music-oasis.com <http://music-oasis.com>) was >ripping us >> off. I believe we told them to cut it out and they did. > >Ehm, not exactly. "Digital DJ Pro" is still listed on their site >with >1.78M downloads. I don't know if it's comforting or horrifying >that it >appears to be based on Mixxx 1.5.0. > >Anyway, I would like to formally hijack this thread to talk about >code >signing (on Windows at least.) I think we should definitely do it >in any >case because it protects against tampering with the executable >(and even >if someone builds it from source, they still can't sign it with >our >cert.) Plus it looks more professional than "We can't verify the >source >of this application." > >StartSSL.com offers 2-year code signing certs for $50 (personal >identity >validation.) > >Thoughts? > >Sincerely, >Sean M. Pappalardo >"D.J. Pegasus" >Mixxx Developer - Controller Specialist ------------------------------------------------------------------------------ Want excitement? Manually upgrade your production database. When you want reliability, choose Perforce Perforce version control. Predictably reliable. http://pubads.g.doubleclick.net/gampad/clk?id=157508191&iu=/4140/ostg.clktrk _______________________________________________ Get Mixxx, the #1 Free MP3 DJ Mixing software Today http://mixxx.org Mixxx-devel mailing list Mixxx-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/mixxx-devel
