<div id="readability-page-1" class="page"><div><div><a rel="noopener  ugc nofollow" href="/?source=post_page-----aaf00409aec2--------------------------------"><div aria-hidden="false"><p><img alt="Jung-Hyun Nam" src="https://miro.medium.com/v2/resize:fill:88:88/2*P1z-D515GRYQ6WaumcAxVQ.png" width="44" height="44" loading="lazy"></p></div></a></div><figure><figcaption>Cover Photo: Photo by <a href="https://unsplash.com/@kenziem?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" rel="noopener ugc nofollow" target="_blank">Mackenzie Marco</a>, <a href="https://unsplash.com/ko/%EC%82%AC%EC%A7%84/XG88BYDSDZA?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText" rel="noopener ugc nofollow" target="_blank">Unsplash</a></figcaption></figure><p id="7b35"><span>W</span>hile things are much better in Korea than they used to be, there are still some core public sector online services that require you to install external software outside of the browser, whether you like it or not. Not only that, but you have to install unproven security hardening software on the Windows OS in the name of maintaining software end-to-end security and encryption.</p><p id="0e63">Naturally, this may be fine in the short term, but in the long term, it increases the likelihood of conflicts with security and feature updates to the Windows OS, causing a loss of productivity. To get around this, you can deploy virtual machines like Hyper-V or VirtualBox, or you can set aside an older, less-used computer, but if you need to use a personal digital signing certificate, you’re taking a risk by creating a separate environment that, if not maintained, could lead to theft of sensitive information.</p><p id="a389">Therefore, I developed an open source software called “Tablecloth” that utilizes the auxiliary feature introduced in Windows 10 called Windows Sandbox and distributed it to users in Korea, and many people were interested in it. Among the features of the sandbox is the ability to automatically initialize the sandbox using an XML file, automatically injecting the auxiliary software and digitally signed certificates that public services need, and when the purpose is achieved, you can completely erase the data by simply closing the sandbox.</p><p id="b7ea">However, there is one problem. Both Windows and Mac OS consider software downloaded from the Internet to be a potential risk, so in order for users to use the software without feeling uncomfortable, they must obtain a code signing certificate to prove that the software is safe. That’s right, “code signing certificate”.</p><p id="cf73">I was pleasantly surprised when I renewed my code signing certificate this year. I’m a full-time software developer living in South Korea, but this project is not associated with my employer. This is a just hobby project, and in order to purchase a new certificate, or get a replacement for an existing one, I must meet the following requirements.</p><ul><li id="5ef2">I need to pay 550,000 won in Korean won for a one-year renewal (that’s roughly $430 in US dollars).</li><li id="df4d">Along with my passport, I need to submit a selfie photo of me holding my passport.</li></ul><p id="af24">I think it’s a reasonable requirement, and it’s a reasonable amount of money, considering who is going to trust an individual to stand behind and vouch for them, but on the flip side, as an open source software developer, it’s heartbreaking to have to spend this much money on a fixed basis every year. It’s not just the money, it’s also the fact that I have to expose my identity to the certificate issuer, which is something that I can only do if I trust them, which is entirely possible.</p><p id="4262">It’s an age-old problem, but there doesn’t seem to be a solution. Either I have another organization, company, or sponsor that will vouch for my identity when issuing code signing certificates, or I have to submit my app under the assumption that it will pass review by the app store. Otherwise, I guess I’ll just have to start a startup!</p><p id="547c">For those of you developing open source software for the desktop (Windows or macOS), I’m curious how you’re dealing with this issue.</p></div></div>

Stories by Jung-Hyun Nam on Medium

The uncomfortable truth about the age-old problem of code signing certificates and open source software
Continue reading on Medium »

Challenges of deploying open source software on Windows

댓글