Microsoft Defender SmartScreen is hurting independent developers
getimageview.net
Microsoft Defender SmartScreen is hurting independent developers
1–10 of 243 posts
Re: Microsoft Defender SmartScreen is hurting independent developers
#2Meanwhile, all bad actors know the best way to deliver malicious code is via javascript exploits in a browser.
Re: Microsoft Defender SmartScreen is hurting independent developers
#3Another tale from a developer on their experience getting a code signing certificate from a certificate authority:
Re: Microsoft Defender SmartScreen is hurting independent developers
#4I am guessing that they'd want you do distribute your program through their "App Store" as a UWP, which is likely subject to sandboxing and will never show the SmartScreen prompts.
Making raw Win32 .exe distribution as user-unfriendly as possible is very likely to be a goal of MS.
Re: Microsoft Defender SmartScreen is hurting independent developers
#5This is clearly a warning, among others, that the bad Microsoft is back.
Using certificates and app signing is OK as long as it is done properly, with as much clarity as possible, and an inexpensive way to get our apps signed.
Re: Microsoft Defender SmartScreen is hurting independent developers
#6This is clearly a warning, among others, that the bad Microsoft is back. Using certificates and app signing is OK as long as it is done properly, with as much clarity as possible, and an inexpensive way to get our apps signed.
Back, how? I don't disagree with the gist of this article, but that SmartScreen window has looked like that for many, many years. It's not new, nothing is back. Microsoft was never fantastic.
The only thing that's new about this article is the bit about WinGet, which is so beta that it's hard to assume that its "SmartScreen means malware" behavior will remain like that.
I do agree with it btw, it's just like how Gmail's spam filters make it super hard to self host email. This is monopolistic behavior under the guise of protecting users, plain and simple.
Re: Microsoft Defender SmartScreen is hurting independent developers
#7Meanwhile, all bad actors know the best way to deliver malicious code is via javascript exploits in a browser.
It might be the best way, but distributing your malware as executable - maybe bundled with some other app - is easy. Plenty of bad actors out there who can’t pull the fancy tricks.
Smartscreen may protect against cases where somebody has for example repackaged WinSCP and distributes it with malware.
Re: Microsoft Defender SmartScreen is hurting independent developers
#8> By this time most users have deleted the .exe already thinking it is a malware, but SmartScreen can be bypassed by clicking on “More info” then “Run anyway”.
What typically happens is people don't even click on more info. They redownload the files and then give up and the files are now collecting bit dust. Source: me.
Also, I think it has been going on for more than a year now.
Re: Microsoft Defender SmartScreen is hurting independent developers
#9Interesting that they aren't doing it the same way as Apple, where you pay to be part of the program and they provide all the certificates. Certainly seems cheaper at $100/yr compared to the prices of these certs.
Also why are these certs so much more expensive compared to a normal SSL certificate?
Re: Microsoft Defender SmartScreen is hurting independent developers
#10Too bad we can't have a Lets Encrypt for desktop. Also the EV certs are effectively dead for the web.
https://www.bleepingcomputer.com/news/software/chrome-and-fi....