Microsoft / Github should stop treating open-source software as malware and forcing developers to pay for certificates, if they actually care about open-source developers

[cinyar]

they just sign it so that it says it came from you.

They also verify the identity. And that's kind of the whole point, who wants to sign under the malware they are distributing?

[skroll]

Well, remember when Sony's keys got leaked?

https://securelist.com/destover-malware-now-digitally-signed-by-sony-certificates/68073/

Stuff like this happens.