> who is signing software without giving a look at what he is signing.
Versign would by proxy, as one example. A certificate authorized to sign code was purchased from them. Samsung would directly, to prove that this shit software came from them.
Just like SSL/TLS. I could set up an SSL website that performs drive-by attacks, would Verisign sign that? Yes, yes they would.
Vericode isn't an gate keeper like Macs certificates are. It's designed to improve security: if I download a Samsung installer Windows will tell me that it is indeed from Samsung (during the UAC elevation) because the signature checks out. This means that I can be certain that unbeknownst malware won't be installed on my PC alongside the Samsung malware.
The story is different with WHDL (drivers), those are signed by Microsoft (in addition to yourself, I think).
Versign would by proxy, as one example. A certificate authorized to sign code was purchased from them. Samsung would directly, to prove that this shit software came from them.
Just like SSL/TLS. I could set up an SSL website that performs drive-by attacks, would Verisign sign that? Yes, yes they would.
Vericode isn't an gate keeper like Macs certificates are. It's designed to improve security: if I download a Samsung installer Windows will tell me that it is indeed from Samsung (during the UAC elevation) because the signature checks out. This means that I can be certain that unbeknownst malware won't be installed on my PC alongside the Samsung malware.
The story is different with WHDL (drivers), those are signed by Microsoft (in addition to yourself, I think).