Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

91–100 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#91

Post by mkup »

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

Microsoft can give out free code-signing certificates like LetsEncrypt, but bind publisher reputation to the domain name, rather than to a particular public key or certificate. In such way, malware makers won't be able to build up enough reputation, because they will have to switch domain names often (and legit software publishers won't be subjects to extortion by Code Signing CAs). Regarding domain expiry problem, this is solved by short-lived certificates (same as for LetsEncrypt) and timestamping server.

Re: Microsoft Defender SmartScreen is hurting independent developers

#92

Post by fh973 »

gigel82 wrote: post #17

I agree in general with what SmartScreen tries to do. There are a lot of non-technical folks clicking on stuff willy-nilly so adding barriers to prevent spyware / virus infections for totally unknown binaries is a good thing. A "Let's Encrypt" for code signing may be a good idea, but the cost of a certificate is itself a barrier for spyware distributors, so i'm conflicted on that... not sure what the right fix is.

The barrier is actually bigger than just money: for an EV certificate you need to prove that you are a registered business. So there is a name and an address behind it, which is kind of a barrier for malware.

Re: Microsoft Defender SmartScreen is hurting independent developers

#93

Post by chooseaname »

AdmiralAsshat wrote: post #40

> “Developers, developers, developers!” was a cry from Steve Ballmer and one of the speeches that defined him as CEO of Microsoft. These infamous words were uttered back in 2006. The famous YouTube video of it was uploaded in 2006, but my sources say the event in question was from Microsoft's 25th Anniversary Event in September 2000. I could use a more authoritative source than knowyourmeme, though, so someone else i…

Also, this is how he got the unofficial nickname "Monkey Boy".

Re: Microsoft Defender SmartScreen is hurting independent developers

#95

Post by ebg13 »

criddell wrote: post #88
ebg13 wrote: post #71

Earlier quoted context omitted.

Bonzi Buddy, as a money making enterprise, would have paid for a signing certificate as a cost of business. This does not save you from Bonzi Buddy.

Sure, Bonzi Buddy might not be the best example, but you get his point. People just click through dialogs to close them without thinking about what they are clicking.

You don't get to handwave away a clear fallacy with "ok but you get the point". _My_ point is that the point is false, not that the example is bad. If Bonzi Buddy can just buy their way into your computer, then this does not save you. From anything. Because real malicious actors like Bonzi Buddy can just buy their way in!

Re: Microsoft Defender SmartScreen is hurting independent developers

#96

Post by jedberg »

As is typical for Microsoft, they again are trying to copy Apple, but failing to get the details right, turning it into a disaster. This behavior used to just be limited to their UI, but now it seems to have passed into their business practices.

I suspect this happened because they were trying to be more secure, but all the Microsoft employees have free access to signing certificates that bypass the checks, so they never ran into these problems.

Re: Microsoft Defender SmartScreen is hurting independent developers

#97

Post by kbenson »

fh973 wrote: post #87
falcolas wrote: post #76

Earlier quoted context omitted.

Funny how Let’s Encrypt is so popular because it doesn’t inconvenience people, and as a result more websites than ever have been secured, to the betterment of society.

There is a huge difference of what kind of identity is established: Let's Encrypt tells you basically that you are actually talking to the right server, whereas EV certs for signing binaries tell you which company that actually exists in the real world owns the certificate.

Also, for a lot of sites they've outsourced their payment systems (which was the main reason for SSL certs in the past), so you can place less importance on the SSL cert if the payment gateway is PayPal, or Amazon, or Squarespace, and they are essentially providing the same assurance (and are a responsible party you can contact to reverse charges if you suspect fraud).

At this point, I'm very hesitant to enter any credit card info into a site itself, even if it's secured through an SSL cert. It doesn't really signify what it used to.

Re: Microsoft Defender SmartScreen is hurting independent developers

#98

Post by jedberg »

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation?

Do what Apple does -- allow me as a user to set a setting that allows unsigned code to run, or allows signed but not recognized code to run, but with a warning that it is signed but not recognized.

They could also fix their warning screen to better explain that it's not necessarily malware.

Re: Microsoft Defender SmartScreen is hurting independent developers

#99

Post by snuxoll »

WorldMaker wrote: post #60
cptskippy wrote: post #52

Earlier quoted context omitted.

Does that mean they're Sandboxed by default. I personally don't care if the package is MSIX, MSI, EXE, or whatever. I just want Sandboxed by default. I really hate worrying what an App like Chrome is doing to my system and I'm reminded every time I launch it because all my Thunderbolt connected monitors black out for a second when it starts up.

Win32 MSIX packages are minimally sandboxed by default. Mostly just in that it virtualizes some file system and Registry changes to ensure the package is clean to uninstall. It doesn't stop Win32 apps from doing crazy Win32 things (unfortunately), but it's still a step up from MSI/EXE installs in general.

MSIX only enforces a sandbox if an application doesn’t elect to use the restricted capabilities that allow it to run without. File system and registry virtualization can be disabled quite easily with a few lines in the package manifest, as well as a host of other isolation features.

This is a good thing, and it makes MSIX a usable packaging format for pretty much any application under the sun - but nobody should assume a MSIX package is safe just because it’s a MSIX package.

Re: Microsoft Defender SmartScreen is hurting independent developers

#100

Post by kevingadd »

jedberg wrote: post #98
gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Do what Apple does -- allow me as a user to set a setting that allows unsigned code to run, or allows signed but not recognized code to run, but with a warning that it is signed but not recognized. They could also fix their warning screen to better explain that it's not necessarily malware.

Windows already works the way you describe. There's a Developer Mode that relaxes some restrictions and SmartScreen lets you run unsigned code even in its default configuration (you have to click More Info to show the button, which is annoying but hardly unique to Windows - security error bypass in most browsers has been this way for ages)
Post reply on HN