Microsoft Defender SmartScreen is hurting independent developers • Hacker News Board

Re: Microsoft Defender SmartScreen is hurting independent developers

#111

Post by kevingadd » Tue, Jun 02, 2020, 6:35 PM UTC

echelon wrote: post #13

More walled gardens. Hooray. This is why we need WASM and web-first development. If the platforms won't empower us to develop and distribute without levying their tax, we need to take our business back to the open web and spend our money on making it the best platform. Besides, it's a nightmare to have to develop for every single platform when the web is universal. Platforms should pay the cost of making things work…

Code-signing and certificates are still necessary even in a WASM environment. Once all your software moves into the web browser, all your important data lives there too and the risk profile of all the third-party code loaded into your websites is incredibly high, just like it is for Chrome and Firefox extensions.

Right now if you're a Windows dev you get harassed by SmartScreen, but if you're a web dev you get to either reinvent the entire stack from the ground up (to control it) or pull in 20 different third-party dependencies, none of which are code-signed, without any easy methods to ensure integrity other than manually listing specific hashes in a fashion that causes your website to break any time a vendor pushes new code. Don't get me started on software that currently only works if deployed as an extension - being an extension developer is one of the worst development experiences on earth

Re: Microsoft Defender SmartScreen is hurting independent developers

#112

Post by driverdan » Tue, Jun 02, 2020, 6:36 PM UTC

fh973 wrote: post #77

ebg13 wrote: post #67

Earlier quoted context omitted.

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking u…

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

As someone who used to make fake IDs it would be very easy to pass EV checks. It's like putting a padlock on a gate. Anyone who wants to get past it can easily do so.

Re: Microsoft Defender SmartScreen is hurting independent developers

#113

Post by kevingadd » Tue, Jun 02, 2020, 6:37 PM UTC

recursive wrote: post #28

tonyedgecombe wrote: post #21

Earlier quoted context omitted.

The cure is worse than the disease. We will just end up with a handful of companies holding our data to ransom.

That may be, but not because of a barrier to entry. (the wall around the garden)

The barrier to entry for integrating with the web ecosystem is way higher than native. I can interop trivially with basically any native app on my machine, meanwhile even basic tasks like 'export my data from this web service' are often difficult or impossible because vendors don't care.

If you are building a custom product from scratch with no need to integrate with users' existing data and services, the barrier to entry is low. But most users have lots of existing data to use and it lives on other services, so you have to integrate... if you can

Re: Microsoft Defender SmartScreen is hurting independent developers

#114

Post by 411111111111111 » Tue, Jun 02, 2020, 6:37 PM UTC

Avamander wrote: post #57

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

> Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs IMO that would still be good. This would help protect against dangerous middlemen, all those massive sites containing thousands of pieces of software, many with added ad- or other badware. If CCleaner (just an random example) could sign their executables for free, then the…

> This would help protect against dangerous middlemen

but if everyone can get their certificate, they can always just sign it with their own...

Re: Microsoft Defender SmartScreen is hurting independent developers

#115

Post by gschrader » Tue, Jun 02, 2020, 6:37 PM UTC

fierarul wrote: post #73

Dear GitHub CEO reading this message on HN: a cool feature would be a GitHub action to sign binaries for free . It's ridiculous that my open source code is hosted on GitHub, the binary is created with an action but I have to pay for a certificate and manually sign it.

Yes this please! I recently found out the hoops one must jump through to sign code, I've basically have given up until one of the CI services will provide a way.

Re: Microsoft Defender SmartScreen is hurting independent developers

#116

Post by jfkebwjsbx » Tue, Jun 02, 2020, 6:37 PM UTC

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

There is no solution to the problem except a curated list.

EV certs should be a one-time payment thing, reasonable price ($100, for example) and require paperwork to link it to a business or individual. Same as the "blue tick" in social apps.

That doesn’t stop everything, but at least it is not the wild west either.

Re: Microsoft Defender SmartScreen is hurting independent developers

#117

Post by sjapps » Tue, Jun 02, 2020, 6:38 PM UTC

xoail wrote: post #24

I recently went through this pain for an electron app. Non-EV code sign cert kept throwing SmartScreen warnings for most users. Acquiring an EV cert forced me to register a company and a hefty cert price per year, overall costing nearly $1500. Not to mention overall delay and added costs. Meanwhile my $100/y Apple Dev subscription was enough to package the app and distribute outside App Store. At this point I am fair…

And yet people bash Apple for collecting $99/year.

Re: Microsoft Defender SmartScreen is hurting independent developers

#118

Post by kevingadd » Tue, Jun 02, 2020, 6:39 PM UTC

fh973 wrote: post #87

falcolas wrote: post #76

Earlier quoted context omitted.

Funny how Let’s Encrypt is so popular because it doesn’t inconvenience people, and as a result more websites than ever have been secured, to the betterment of society.

There is a huge difference of what kind of identity is established: Let's Encrypt tells you basically that you are actually talking to the right server, whereas EV certs for signing binaries tell you which company that actually exists in the real world owns the certificate.

And aside from signing certs being a racket, it makes sense for LE to be easier than getting a code signing cert! If the server I land on is a malicious website, I can close the tab. If the app I installed turns out to be malicious odds are good that I have to reformat my machine and restore an old backup, plus change all my security credentials because the malware exfiltrated them.

Re: Microsoft Defender SmartScreen is hurting independent developers

#119

Post by bastardoperator » Tue, Jun 02, 2020, 6:39 PM UTC

driverdan wrote: post #112

fh973 wrote: post #77

Earlier quoted context omitted.

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

As someone who used to make fake IDs it would be very easy to pass EV checks. It's like putting a padlock on a gate. Anyone who wants to get past it can easily do so.

Locks only keep honest people out

Re: Microsoft Defender SmartScreen is hurting independent developers

#120

Post by haolez » Tue, Jun 02, 2020, 6:40 PM UTC

ebg13 wrote: post #83

fh973 wrote: post #77

Earlier quoted context omitted.

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.

This is in line with my experience. I've worked with cybersecurity in the past and the "attackers" used to be huge black hat companies that had much more money and power than all white hat companies combined. We joked that only the bad guys went to work using suits, since they are very powerful and well organized :)