Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

21–30 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#21

Post by tonyedgecombe »

echelon wrote: post #13

More walled gardens. Hooray. This is why we need WASM and web-first development. If the platforms won't empower us to develop and distribute without levying their tax, we need to take our business back to the open web and spend our money on making it the best platform. Besides, it's a nightmare to have to develop for every single platform when the web is universal. Platforms should pay the cost of making things work…

The cure is worse than the disease. We will just end up with a handful of companies holding our data to ransom.

Re: Microsoft Defender SmartScreen is hurting independent developers

#22

Post by diego_moita »

> The digital signature racket

> The price range is wide but a certificate only valid for a year will typically go for about $100.

This is hypocrisy, smells like Apple-fanboy trolling. MS stimulates competition on the code signing certificates and it is free to deploy through their appstore. And you can bypass Smartscreen right from the warning.

Certificates cost $59.00 at codesigncert[0], not "about $100.00". Established developers with reputation don't need certificates.

Now compare that with Apple's (much more walled) approach: only Apple sells the certificate at the price of $99,00, even to deploy on their Mac store (where they'll also take a cut) and it is not trivial to bypass their screen.

[0] https://codesigncert.com/comodo-individual-code-signing

Edit: I don't like MS codesigning implementation, but they are not the worst on this game.

Re: Microsoft Defender SmartScreen is hurting independent developers

#23

Post by cptskippy »

AshamedCaptain wrote: post #4

I am guessing that they'd want you do distribute your program through their "App Store" as a UWP, which is likely subject to sandboxing and will never show the SmartScreen prompts. Making raw Win32 .exe distribution as user-unfriendly as possible is very likely to be a goal of MS.

Honestly I am all for sandboxing by default and scary prompts for anything that doesn't subject itself to strict sandboxing or that tries to break out of it. That doesn't mean apps necessarily have to come from a MS curated store either, just that by default the run in a sandboxed context with access to dick squat on my system.

I absolutely hate when I install something like Adobe Acrobat and it installs 18 schedule tasks, a startup job to ensure those task exist, a tray icon to monitor it's services and all the other crap. No thanks.

I also don't want to have to worry about installing some random app I found on SourceForge that purports to do what I want but might come with the SF equivalent of News Gator side loaded.

Lock it all down by default in a virtual sandbox by default and if it needs legitimate access to my files, prompt me to grant it access.

Re: Microsoft Defender SmartScreen is hurting independent developers

#24

Post by xoail »

I recently went through this pain for an electron app. Non-EV code sign cert kept throwing SmartScreen warnings for most users. Acquiring an EV cert forced me to register a company and a hefty cert price per year, overall costing nearly $1500. Not to mention overall delay and added costs.

Meanwhile my $100/y Apple Dev subscription was enough to package the app and distribute outside App Store.

At this point I am fairly certain EV certs are nothing but rackets supported by MS.

Re: Microsoft Defender SmartScreen is hurting independent developers

#25

Post by munchbunny »

The part that is insane to me is the idea that there is no way as a developer to get a "this product was reviewed and certified clean" label to guarantee a clean installation UX, even after buying a code signing certificate.

SmartScreen seems like a great idea for protecting the end user, but without ways to remediate "reputation" problems with some form of prior review, this makes the software ecosystem shitty especially for individuals and small software outfits.

Re: Microsoft Defender SmartScreen is hurting independent developers

#26

Post by tonyedgecombe »

samcat116 wrote: post #9

Interesting that they aren't doing it the same way as Apple, where you pay to be part of the program and they provide all the certificates. Certainly seems cheaper at $100/yr compared to the prices of these certs. Also why are these certs so much more expensive compared to a normal SSL certificate?

Also why are these certs so much more expensive compared to a normal SSL certificate?

There is some manual intervention, you usually end up with phone calls and emailing documents to and fro before the certificate is issued.

I last renewed mine in 2017, I'm dreading doing it next year as I don't have a public phone number which always causes problems. Sticking sharpened pencils in my eyes would probably be a more pleasurable experience.

Re: Microsoft Defender SmartScreen is hurting independent developers

#27

Post by Anon4Now »

skrebbel wrote: post #6
stephc_int13 wrote: post #5

This is clearly a warning, among others, that the bad Microsoft is back. Using certificates and app signing is OK as long as it is done properly, with as much clarity as possible, and an inexpensive way to get our apps signed.

Back, how? I don't disagree with the gist of this article, but that SmartScreen window has looked like that for many, many years. It's not new, nothing is back. Microsoft was never fantastic. The only thing that's new about this article is the bit about WinGet, which is so beta that it's hard to assume that its "SmartScreen means malware" behavior will remain like that. I do agree with it btw, it's just like how Gmai…

> but that SmartScreen window has looked like that for many, many years

It changed a year or two ago. The "Run Anyways" button used to be on the main dialog. Now the user has to click the "More Info" button to see that option.

Re: Microsoft Defender SmartScreen is hurting independent developers

#28

Post by recursive »

tonyedgecombe wrote: post #21
echelon wrote: post #13

More walled gardens. Hooray. This is why we need WASM and web-first development. If the platforms won't empower us to develop and distribute without levying their tax, we need to take our business back to the open web and spend our money on making it the best platform. Besides, it's a nightmare to have to develop for every single platform when the web is universal. Platforms should pay the cost of making things work…

The cure is worse than the disease. We will just end up with a handful of companies holding our data to ransom.

That may be, but not because of a barrier to entry. (the wall around the garden)

Re: Microsoft Defender SmartScreen is hurting independent developers

#30

Post by xoail »

diego_moita wrote: post #22

> The digital signature racket > The price range is wide but a certificate only valid for a year will typically go for about $100. This is hypocrisy, smells like Apple-fanboy trolling. MS stimulates competition on the code signing certificates and it is free to deploy through their appstore. And you can bypass Smartscreen right from the warning. Certificates cost $59.00 at codesigncert[0], not "about $100.00". Establ…

User are generally not tech savy to bypass Smartscreen warning by themselves.
Post reply on HN