#cryptographically — Public Fediverse posts

The #LG [1] privacy / security debacle - where merely plugging in one of their monitors *silently* installs a spyware/adware application with system-level #privileges [2] and sets it to auto-start, also silently - reminded me of a question I've wondered about.

The last version of Windows that I ran was Win98, so I'm rather out-of-date on my knowledge. It now supports #cryptographically signing programs [3] so you can #authenticate the source. I gather things distributed by the Microsoft store are all signed this way, but also #software distributed independently by larger companies.

So my questions are:

a) are programs from different companies signed with those companies' keys? Or is everything signed with a #Microsoft key so you can't differentiate between sources?

b) can users blocklist particular #signing #keys? Or are these solely for Microsoft's benefit and only they can decide what keys are acceptable?

Because if I was a #Windows user now, I would definitely want to #blocklist LG's signing key.

[1] Am I the only one who used to sell their stuff when they used their full name?

[2] Only with #Windows, natch.

[3] I'll start calling programs "apps" when I'm dead, thanks.

#LuckyGoldstar #adware #spyware #untrustworthy #UntrustedSoftware

For the 2nd time in weeks, #Microsoft packages laced with #credential stealer

Dozens of #cryptographically verified #opensource packages from Microsoft were #compromised late last week to add advanced credential-stealing code that was triggered when #developers opened them in #AI coding #agents.

In all, multiple researchers said, 73 packages were flagged as #malicious when automated systems on #GitHub blocked them on the platform. Rather than noting they are malicious—and that developers who used #AIagents to work with them should assume their systems are compromised—the Microsoft-owned GitHub said it disabled the packages “due to a violation of GitHub's terms of service.” The text went on to encourage the package owner to contact GitHub.
#security

https://arstechnica.com/security/2026/06/for-the-2nd-time-in-weeks-microsoft-packages-laced-with-credential-stealer/

$391.5 million restitution from @[email protected] for data privacy lawsuit, #cryptographically signing ZIP files, and a new privacy attack #exploiting every WiFi device in your building. Listen to Steve Gibson and @leo for more topics like this on Security Now:
https://twit.tv/shows/security-now/episodes/898?autostart=false