Skip to main content
Information Security

Return to Question

Tweeted twitter.com/StackSecurity/status/719435959612350464
grammar
Source Link
Mike Ounsworth
Mike Ounsworth
  • 59.3k
  • 21
  • 162
  • 214

Should I sign someone elseelse's code?

I'm working on a product that includeincludes 3rd party drivers for some onof the productsproduct's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.

Given that getting new, Sha2sha2 signed (or dual signed) drivers from all the 3rd parties is going to be very difficult, if not impossible, should I sign the drivers I have with my companiescompany's code-signing certificate?

What are the implications, both technical and legal, in signing someone else code? Does it confer more than just "we've tested this version of the driver and trust it"?

Should I sign someone else code

I'm working on a product that include 3rd party drivers for some on the products hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.

Given that getting new, Sha2 signed (or dual signed) drivers from all the 3rd parties is going to be very difficult, if not impossible, should I sign the drivers I have with my companies code-signing certificate?

What are the implications, both technical and legal, in signing someone else code? Does it confer more than just "we've tested this version of the driver and trust it"?

Should I sign someone else's code?

I'm working on a product that includes 3rd party drivers for some of the product's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.

Given that getting new, sha2 signed (or dual signed) drivers from all the 3rd parties is going to be very difficult, if not impossible, should I sign the drivers I have with my company's code-signing certificate?

What are the implications, both technical and legal, in signing someone else code? Does it confer more than just "we've tested this version of the driver and trust it"?

Source Link
Grhm
Grhm
  • 213
  • 1
  • 7

Should I sign someone else code

I'm working on a product that include 3rd party drivers for some on the products hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.

Given that getting new, Sha2 signed (or dual signed) drivers from all the 3rd parties is going to be very difficult, if not impossible, should I sign the drivers I have with my companies code-signing certificate?

What are the implications, both technical and legal, in signing someone else code? Does it confer more than just "we've tested this version of the driver and trust it"?