Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

101–110 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#101

Post by jimnotgym »

xoail wrote: post #64
gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

Just do what Apple does. Own the certification and recognize trustworthy developers. Allow new devs to easily distribute and ban/block them if they turn malicious. Its not a perfect solution but is in the right direction IMHO.

And if Apple make a mistake and exclude you from the market incorrectly who does one appeal to?

I would rather Windows didn't become another walled garden.

Re: Microsoft Defender SmartScreen is hurting independent developers

#102

Post by snuxoll »

falcolas wrote: post #79
Wowfunhappy wrote: post #45

At least for standard apps, the user can bypass the warning. For drivers, it gets much worse. On 64 bit versions of Windows, there is no way for me to permanently allow unsigned drivers. Every time I want to install an unsigned driver, I have to reboot my computer while holding down shift, select advanced startup options, and then hit "7" on a USB keyboard which I lug out of the closet because my Bluetooth keyboard w…

And yet videogames can easily install Ring-0 “anti-cheat” software with no special privileges or steps required.

Because they get signed.

Re: Microsoft Defender SmartScreen is hurting independent developers

#103

Post by mikewhy »

nerdjon wrote: post #61

Can someone break down how this compares to what Apple does with Mac? The basic gist I have is for Apple you have a yearly fee of $100(USD) but that covers all of your apps. Where Microsoft is per app and looks to be about $100 a year (depending on how far in advance you pay) and then also have another piece on top of it regarding how often its used. Is there more to what Microsoft is doing or areas where what Apple…

One big difference is that this $100/yr (ish) for MS side of things doesn't actually bypass smart screen on its own. Smart screen stops showing up if more people eventually install and use your app (black box). If you want to bypass it out of the gate, you need an EV Cert. Which are hundreds more (further down this article quotes one at $700), and require more effort on the business side of things.

Re: Microsoft Defender SmartScreen is hurting independent developers

#104

Post by ksm »

We have been bitten with this one, multiple times now over the years but seems to have gotten worse.

Our otherwise SaaS product requires an installable component for our customers PCs, from installation package (MSI and/or EXE) that we generate on the fly per customer -basis in order to customize data inside the installer for each tenant. For this reason, the timestamping of digital signature varies between packages as does the hash [of the content], and for _months_ after we have renewed our signing certificate we get support messages about both Smart Screen "scary warnings" as well as from some AV products as well. Despite number of downloads for runs for the package(s) signed with one and the same signature.

As the article mentions, it does not matter if you have had previous certificate; each renewal (=new certificate technically) starts this reputation process from zero. What's worse, since the signing happens on the [Windows] server as part of the product itself we really cannot use EV certificates either as those require physical USB dongles to be attached to machine doing the signing.. so we are left only with option of using regular certificate that gets this treatment. Sure, 10 year certificate would postpone the issue for a long time, but for security purposes we actually want to recycle those signing certificates with one to two year interval so the problem always resurfaces regularly.

Re: Microsoft Defender SmartScreen is hurting independent developers

#105

Post by lima »

ebg13 wrote: post #83
fh973 wrote: post #77

Earlier quoted context omitted.

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.

What usually happens is that legitimate certificates are stolen.

Re: Microsoft Defender SmartScreen is hurting independent developers

#106

Post by kevingadd »

lostmsu wrote: post #78
alkonaut wrote: post #47

Earlier quoted context omitted.

Isn't this exactly how ssl works too, and that also cost around this sum of money up until recently (with LetsEncrypt)?

I think a major difference here is that LetsEncrypt relies on an already existing third-party authority, that generally has some scrutiny to it: DNS registrars.

Not sure what you mean here, code signing certs are issued by many of the same companies that were issuing SSL certs before LE existed

Re: Microsoft Defender SmartScreen is hurting independent developers

#107

Post by my123 »

Wowfunhappy wrote: post #45

At least for standard apps, the user can bypass the warning. For drivers, it gets much worse. On 64 bit versions of Windows, there is no way for me to permanently allow unsigned drivers. Every time I want to install an unsigned driver, I have to reboot my computer while holding down shift, select advanced startup options, and then hit "7" on a USB keyboard which I lug out of the closet because my Bluetooth keyboard w…

There is:

bcdedit -set testsigning on and bcdedit -set nointegritychecks on

Re: Microsoft Defender SmartScreen is hurting independent developers

#108

Post by ripley12 »

I asked the MSIX team about code signing at Build recently, they said they will be previewing "Azure Trust Service" this summer which makes code signing easier: https://twitter.com/jvintzel/status/1262794128351322114

The current code signing situation on Windows is painful. It's especially galling how the code signing requirements apply to modern sandboxed Windows applications as well - an MSIX-packaged application with minimal capabilities is subject to the same requirements as an EXE that can do anything.

Re: Microsoft Defender SmartScreen is hurting independent developers

#109

Post by [deleted] »

smacktoward wrote: post #70
umvi wrote: post #56

Earlier quoted context omitted.

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? They can keep SmartScreen in place, but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source.

Every single person who installed Bonzi Buddy thought they were getting it from a good source.

[deleted]

Re: Microsoft Defender SmartScreen is hurting independent developers

#110

Post by [deleted] »

criddell wrote: post #88
ebg13 wrote: post #71

Earlier quoted context omitted.

Bonzi Buddy, as a money making enterprise, would have paid for a signing certificate as a cost of business. This does not save you from Bonzi Buddy.

Sure, Bonzi Buddy might not be the best example, but you get his point. People just click through dialogs to close them without thinking about what they are clicking.

[deleted]
Post reply on HN