Are there any zero-cost options for code signing open source Windows apps that are free to use and will never generate revenue of any kind?
Microsoft Defender SmartScreen is hurting independent developers
51–60 of 243 posts
Re: Microsoft Defender SmartScreen is hurting independent developers
#52Earlier quoted context omitted.
> That doesn't mean apps necessarily have to come from a MS curated store either, just that by default the run in a sandboxed context with access to dick squat on my system. This is absolutely possible. You can distribute your UWP app as an MSIX package[0], which allows side-loading without having to go through the store. The whole experience is actually quite nice and straightforward, UI-wise. [0]: https://docs.micr…
You can also distribute classic win32 apps with MSIX as well
Does that mean they're Sandboxed by default. I personally don't care if the package is MSIX, MSI, EXE, or whatever. I just want Sandboxed by default.
I really hate worrying what an App like Chrome is doing to my system and I'm reminded every time I launch it because all my Thunderbolt connected monitors black out for a second when it starts up.
Re: Microsoft Defender SmartScreen is hurting independent developers
#53I am guessing that they'd want you do distribute your program through their "App Store" as a UWP, which is likely subject to sandboxing and will never show the SmartScreen prompts. Making raw Win32 .exe distribution as user-unfriendly as possible is very likely to be a goal of MS.
Honestly I am all for sandboxing by default and scary prompts for anything that doesn't subject itself to strict sandboxing or that tries to break out of it. That doesn't mean apps necessarily have to come from a MS curated store either, just that by default the run in a sandboxed context with access to dick squat on my system. I absolutely hate when I install something like Adobe Acrobat and it installs 18 schedule…
MSIX tries to be exactly that. It supports the gamut of Win32 so long as they can be minimally sandboxed. Win32 apps in MSIX still have access to everything and can't be entirely trusted, but the installer will warn you about that a lot less "scarily" than the SmartScreen Defender prompt this author doesn't like.
MSIX can be sideloaded by default in every supported version of Windows (in addition to or rather than Store installed) (supported versions of Windows include 7, 8, 8.1, and 10 after the Anniversary Update). MSIX support auto-updating even when sideloaded, all it takes is an HTTPS server with some simple manifests (for those that remember ClickOnce it is reminiscent but a lot easier/cleaner), or for Enterprises a file share will do.
The only caveat is that MSIX requires Code Signing Certificates for sideloading. (Note that makes Store install is a "cheaper" option with the $99/year and Microsoft handles the package signing for you as a part of the approval process.)
My biggest gripe with WinGet as a project (and no, the article is wrong it's not intended to replace the Store) is that it isn't doing way more to bootstrap MSIX packages instead of "downloading and running EXEs like always before".
Re: Microsoft Defender SmartScreen is hurting independent developers
#54I can certainly empathize with the author. How many executions are we talking about though? 10, 100, 1000?
Seems like a dev w/ a new certificate could post a build of said application to a dev-friendly space to "bootstrap" the process.
Certainly not practical in many scenarios, but that's why I was curious about how many it takes.
Re: Microsoft Defender SmartScreen is hurting independent developers
#55I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…
Absolutely.
I think it's easy for the HN crowd to inadvertently forget what computers / phones / tablets / TVs look like to ordinary people.
I would encourage people to come up with actual use-cases and pro-con scenarios rather than 100% "emotion mind" opinions.
Re: Microsoft Defender SmartScreen is hurting independent developers
#56I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…
> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation?
They can keep SmartScreen in place, but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source.
Re: Microsoft Defender SmartScreen is hurting independent developers
#57I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…
> Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs
IMO that would still be good.
This would help protect against dangerous middlemen, all those massive sites containing thousands of pieces of software, many with added ad- or other badware. If CCleaner (just an random example) could sign their executables for free, then there'd be a very justified suspicion if it isn't signed.
Not to mention, does the existence of a cert really make a piece of (proprietary) software trustworthy?
Re: Microsoft Defender SmartScreen is hurting independent developers
#58Application signing is a mafia protection racket, plain and simple. If you aren't signed by an "authority", every user is told by default automatically that your code is unsafe until you pay money. It is 100% analogous to thugs walking into your store saying "It would be a real shame if something were to happen to scare people away." The message is "We Protected You" and "Unsafe". WHY? Because "WE don't recognize" it…
First they came for the iOS developers, and I did not speak out, because I wasn't an iOS developer. Then they came for the Windows developers, and I did not speak out, because I wasn't a Windows developer... I sure wish I could distribute the software I write without paying some rent-collector (at least) $100 for the privilege.
The problem isn't the rent. It may be an inconvenience for an indie developer, but to Microsoft, Apple, etc. the cost of a yearly developer account is peanuts. They are not doing it hoping to make excessive amounts of money. Even if Apple has a million developers paying $100, $100M is barely a blip on their radar.
It is all about control. They get to decide whose software gets to run with and whose without annoyances.
Re: Microsoft Defender SmartScreen is hurting independent developers
#59Completely agree. Just a rebuild of an MSI the other day turned up a false positive in windows defender and it’s still stuck in smartscreen today despite MSFT fixing the AV definitions.
Cost me three days.
Re: Microsoft Defender SmartScreen is hurting independent developers
#60Earlier quoted context omitted.
You can also distribute classic win32 apps with MSIX as well
Does that mean they're Sandboxed by default. I personally don't care if the package is MSIX, MSI, EXE, or whatever. I just want Sandboxed by default. I really hate worrying what an App like Chrome is doing to my system and I'm reminded every time I launch it because all my Thunderbolt connected monitors black out for a second when it starts up.
Win32 MSIX packages are minimally sandboxed by default. Mostly just in that it virtualizes some file system and Registry changes to ensure the package is clean to uninstall.
It doesn't stop Win32 apps from doing crazy Win32 things (unfortunately), but it's still a step up from MSI/EXE installs in general.