61–70 of 243 posts
The basic gist I have is for Apple you have a yearly fee of $100(USD) but that covers all of your apps.
Where Microsoft is per app and looks to be about $100 a year (depending on how far in advance you pay) and then also have another piece on top of it regarding how often its used.
Is there more to what Microsoft is doing or areas where what Apple is doing is shady?
Now we're getting to the point that this feels like a protection racket. It, at least in theory, is possible for individuals to get EV certificates for websites. Worst case scenario, you can get a one man business for the paperwork.
A lot of viruses can hit via either remote code execution, or exploiting a bug when loaded through a data file. Neither of those scenarios is stopped by SmartScreen. At best, it stops someone from clicking "WannaCry.exe".
MSFT is basically doing everything to make you use the Store, and it reeked back with Windows RT, and it reeks even more now.
Unfortunately, it seems MSFT is incapable of creating a version of Windows that doesn't have live tiles, constantly tracking what applications you run. I switched to Linux years ago, but I realize that most people live in a Windows ecosystem, and that they're subject to the whims of MSFT.
More walled gardens. Hooray. This is why we need WASM and web-first development. If the platforms won't empower us to develop and distribute without levying their tax, we need to take our business back to the open web and spend our money on making it the best platform. Besides, it's a nightmare to have to develop for every single platform when the web is universal. Platforms should pay the cost of making things work…
This is why we need WASM and web-first development. This is only going to make things worse. If everything is a web application, why would users even need access to their hardware or be able to modify their operating system? Boot from an locked bootloader that only loads a FAANG-signed shim OS, that only loads a FAANG-signed web browser. Next, disallow extensions and ad blockers and we are in the brave new web world…
I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…
Eventually a user who was also software developer offered to sign the binaries for me with his certificate and that's how I've operated since.
At least for standard apps, the user can bypass the warning. For drivers, it gets much worse. On 64 bit versions of Windows, there is no way for me to permanently allow unsigned drivers. Every time I want to install an unsigned driver, I have to reboot my computer while holding down shift, select advanced startup options, and then hit "7" on a USB keyboard which I lug out of the closet because my Bluetooth keyboard w…
I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…
Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking up what I'm putting down, great. I also care about my users, so I'll happily mark my applications.
But you don't need to take $100/year from me for the right to not have thugs block access.
> Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates.
Malware exists to make money. Therefore malware authors can easily pay for certificates as a cost of business. Megacorp software fucks people over all the time. It exfiltrates their browsing history, MITMs their secure connections, installs rootkits and backdoors. Please don't pretend that this increases security.
I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…
> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? They can keep SmartScreen in place, but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source.
I'm not sure whether that helps. The dunning-kruger effect will invariably cause novice users to skip those warnings because they think they "know computers", and "wouldn't fall for scams".
I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…
Which means it’s not frequently seen, which means it’s flagged, which means it’s not frequently seen, which means...
One simple solution is don’t flag “not frequently seen” with the “interfere with installation” flag. Ditto developer certificates.
Does it open up a potential attack vector? Yes. But it removes an algorithmic, uncompromising, and artificial hurdle for independent developers, which is better for users IMO.
I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…
> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? They can keep SmartScreen in place, but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source.