Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

71–80 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#71

Post by ebg13 »

smacktoward wrote: post #70
umvi wrote: post #56

Earlier quoted context omitted.

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? They can keep SmartScreen in place, but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source.

Every single person who installed Bonzi Buddy thought they were getting it from a good source.

Bonzi Buddy, as a money making enterprise, would have paid for a signing certificate as a cost of business. This does not save you from Bonzi Buddy.

Re: Microsoft Defender SmartScreen is hurting independent developers

#72

Post by WorldMaker »

johnchristopher wrote: post #8

> By this time most users have deleted the .exe already thinking it is a malware, but SmartScreen can be bypassed by clicking on “More info” then “Run anyway”. What typically happens is people don't even click on more info. They redownload the files and then give up and the files are now collecting bit dust. Source: me. Also, I think it has been going on for more than a year now.

SmartScreen Defender has been in every version of Windows 10 since launch.

Re: Microsoft Defender SmartScreen is hurting independent developers

#73

Post by fierarul »

Dear GitHub CEO reading this message on HN: a cool feature would be a GitHub action to sign binaries for free.

It's ridiculous that my open source code is hosted on GitHub, the binary is created with an action but I have to pay for a certificate and manually sign it.

Re: Microsoft Defender SmartScreen is hurting independent developers

#74

Post by WorldMaker »

samcat116 wrote: post #9

Interesting that they aren't doing it the same way as Apple, where you pay to be part of the program and they provide all the certificates. Certainly seems cheaper at $100/yr compared to the prices of these certs. Also why are these certs so much more expensive compared to a normal SSL certificate?

Microsoft provides an option to do exactly that. Microsoft Store will handle all the certificates for you for $100/year and their Store cut is smaller than Apple's if you decide to sell through the Store.

Re: Microsoft Defender SmartScreen is hurting independent developers

#75

Post by WorldMaker »

munchbunny wrote: post #25

The part that is insane to me is the idea that there is no way as a developer to get a "this product was reviewed and certified clean" label to guarantee a clean installation UX, even after buying a code signing certificate. SmartScreen seems like a great idea for protecting the end user, but without ways to remediate "reputation" problems with some form of prior review, this makes the software ecosystem shitty espec…

SmartScreen has a manual review submission process: https://docs.microsoft.com/en-us/windows/security/threat-pro...

Re: Microsoft Defender SmartScreen is hurting independent developers

#76

Post by falcolas »

kbenson wrote: post #15
vanilla-almond wrote: post #3

Another tale from a developer on their experience getting a code signing certificate from a certificate authority: https://twitter.com/hanspagel/status/1262317935898566658

Eh, honestly, that's what getting an SSL cert used to be like 15 years ago. They can knock it all they want, but really, the process functioned pretty much as expected. Like a lock on your front door, the purpose is not to prevent unwanted people from ever getting inside (no lock will ever accomplish that), but to both make it take long enough the likelihood of being noticed is high, and to put enough hurdles in plac…

Funny how Let’s Encrypt is so popular because it doesn’t inconvenience people, and as a result more websites than ever have been secured, to the betterment of society.

Re: Microsoft Defender SmartScreen is hurting independent developers

#77

Post by fh973 »

ebg13 wrote: post #67
gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking u…

Not that simple to just pay. You need an EV certificate (https://en.m.wikipedia.org/wiki/Extended_Validation_Certific...), which in turn needs a verified business address.

Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

Re: Microsoft Defender SmartScreen is hurting independent developers

#78

Post by lostmsu »

alkonaut wrote: post #47
ebg13 wrote: post #42

Application signing is a mafia protection racket, plain and simple. If you aren't signed by an "authority", every user is told by default automatically that your code is unsafe until you pay money. It is 100% analogous to thugs walking into your store saying "It would be a real shame if something were to happen to scare people away." The message is "We Protected You" and "Unsafe". WHY? Because "WE don't recognize" it…

Isn't this exactly how ssl works too, and that also cost around this sum of money up until recently (with LetsEncrypt)?

I think a major difference here is that LetsEncrypt relies on an already existing third-party authority, that generally has some scrutiny to it: DNS registrars.

Re: Microsoft Defender SmartScreen is hurting independent developers

#79

Post by falcolas »

Wowfunhappy wrote: post #45

At least for standard apps, the user can bypass the warning. For drivers, it gets much worse. On 64 bit versions of Windows, there is no way for me to permanently allow unsigned drivers. Every time I want to install an unsigned driver, I have to reboot my computer while holding down shift, select advanced startup options, and then hit "7" on a USB keyboard which I lug out of the closet because my Bluetooth keyboard w…

And yet videogames can easily install Ring-0 “anti-cheat” software with no special privileges or steps required.

Re: Microsoft Defender SmartScreen is hurting independent developers

#80

Post by mikewhy »

xoail wrote: post #24

I recently went through this pain for an electron app. Non-EV code sign cert kept throwing SmartScreen warnings for most users. Acquiring an EV cert forced me to register a company and a hefty cert price per year, overall costing nearly $1500. Not to mention overall delay and added costs. Meanwhile my $100/y Apple Dev subscription was enough to package the app and distribute outside App Store. At this point I am fair…

Exact same story here.

Spent an afternoon comparing different (very sketchy yet somehow the best in Windows code sign cert land) sites, finally picked one, signed the app and downloaded it on another machine.

Was immediately greeted with Smart screen, and learned I needed to shell out HUNDREDS more to get rid of it.

What a racket. And something Apple do automatically for you (provided you pay for their developer program).

Post reply on HN