Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

131–140 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#131

Post by notyourday »

driverdan wrote: post #112
fh973 wrote: post #77

Earlier quoted context omitted.

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

As someone who used to make fake IDs it would be very easy to pass EV checks. It's like putting a padlock on a gate. Anyone who wants to get past it can easily do so.

I have a hard time believing this. Based on my experience, a part of the EV check was checking of the business entity with the state and sending snail mail to the address of record. Since our registered address was a law firm, I had to go through all kinds of hoops to get that letter as it contained the string needed to proceed to the next step in the EV verification.

Re: Microsoft Defender SmartScreen is hurting independent developers

#132

Post by Wowfunhappy »

my123 wrote: post #107
Wowfunhappy wrote: post #45

At least for standard apps, the user can bypass the warning. For drivers, it gets much worse. On 64 bit versions of Windows, there is no way for me to permanently allow unsigned drivers. Every time I want to install an unsigned driver, I have to reboot my computer while holding down shift, select advanced startup options, and then hit "7" on a USB keyboard which I lug out of the closet because my Bluetooth keyboard w…

There is: bcdedit -set testsigning on and bcdedit -set nointegritychecks on

This works for some drivers and not others! EDID overrides, for example, require the rigamarole I described. (The command you mentioned does need to be run regardless, or even drivers installed when rebooted into the special mode will actually stop working after the next reboot.)

If anyone understands more about the differences, I'd be very curious to learn more...

Re: Microsoft Defender SmartScreen is hurting independent developers

#133

Post by SXX »

fh973 wrote: post #77
ebg13 wrote: post #67

Earlier quoted context omitted.

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking u…

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

Registering offshore company with a fake passport will take whole $300 out of malware distributor pocket. Or might be $500 if they need random homeless guy to pass interview for them.

Re: Microsoft Defender SmartScreen is hurting independent developers

#134

Post by novok »

alkonaut wrote: post #47
ebg13 wrote: post #42

Application signing is a mafia protection racket, plain and simple. If you aren't signed by an "authority", every user is told by default automatically that your code is unsafe until you pay money. It is 100% analogous to thugs walking into your store saying "It would be a real shame if something were to happen to scare people away." The message is "We Protected You" and "Unsafe". WHY? Because "WE don't recognize" it…

Isn't this exactly how ssl works too, and that also cost around this sum of money up until recently (with LetsEncrypt)?

It was about $10-$20/year although.

Re: Microsoft Defender SmartScreen is hurting independent developers

#135

Post by Nextgrid »

notyourday wrote: post #131
driverdan wrote: post #112

Earlier quoted context omitted.

As someone who used to make fake IDs it would be very easy to pass EV checks. It's like putting a padlock on a gate. Anyone who wants to get past it can easily do so.

I have a hard time believing this. Based on my experience, a part of the EV check was checking of the business entity with the state and sending snail mail to the address of record. Since our registered address was a law firm, I had to go through all kinds of hoops to get that letter as it contained the string needed to proceed to the next step in the EV verification.

You can recruit a clueless person to be a “virtual assistant” or similar, give them some random admin tasks (to make it feel legitimate) before sending the letter to their address and asking them to read/scan the contents for you.

A similar approach is successfully used by scammers to recruit money mules.

Re: Microsoft Defender SmartScreen is hurting independent developers

#136

Post by ripley12 »

kevingadd wrote: post #122
ripley12 wrote: post #108

I asked the MSIX team about code signing at Build recently, they said they will be previewing "Azure Trust Service" this summer which makes code signing easier: https://twitter.com/jvintzel/status/1262794128351322114 The current code signing situation on Windows is painful. It's especially galling how the code signing requirements apply to modern sandboxed Windows applications as well - an MSIX-packaged application w…

I think there's an argument to be made that sandboxing shouldn't exempt you from security restrictions. Unless the sandbox is entirely impossible to penetrate (making apps borderline useless), a malicious app still has many opportunities to trick the user or exploit security vulnerabilities. Revocable signing certificates are a useful tool for fighting back against hostile actors. The certs should be much cheaper, th…

That makes a lot of sense - I think making signing easier should be the goal, not removing signing requirements entirely.

Part of my frustration comes from this paradox: it's harder than it used to be to share a native application with others, even though we now have sandboxing that makes it significantly safer.

It feels like most of the pieces are in place, MSIX has matured to the point where it's pretty easy to distribute an application that runs in a sandbox with auto-updating. If Microsoft can just make the signing part easier, I think we'll see a much more vibrant community around native app development.

Re: Microsoft Defender SmartScreen is hurting independent developers

#137

Post by missedthecue »

vanilla-almond wrote: post #3

Another tale from a developer on their experience getting a code signing certificate from a certificate authority: https://twitter.com/hanspagel/status/1262317935898566658

When I tried to get one for a project I was working on, it was a horrible convoluted hell.

They needed all kinds of things scanned and sent to them. They wanted 2 government IDs, 2 financial documents and 2 non-financial documents. Everything had to be notarized. I had to get my financial documents notarized on a different day than the other documents, and had to have a different notary do those. They would not accept two different notaries that worked in the same office, or for the same organization. (In my case, my local banking branch).

Finally was able to get everything sent in and then they asked me to notarize and sign an additional document called the "face-to-face". So I get that in. All told, it takes them over a month to verify the certificate. They send me the link and key to download it. In the email they send, they say that I can use IE, Firefox or Chrome. I use Chrome. The certificate is corrupted upon download. I tell them and they say it's because I used Chrome. I forward them the email they had sent me that specifically stated chrome could be used. They refuse own up to it and re-issue and because it had been 30 days since purchase, I could not get a refund.

It was such a horrible pain that I just gave up on my project and never published it, rather than go through the whole process again. There has got to be an easier way to verify someone is in fact a human.

Re: Microsoft Defender SmartScreen is hurting independent developers

#138

Post by fny »

fh973 wrote: post #77
ebg13 wrote: post #67

Earlier quoted context omitted.

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking u…

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

You can buy a verified business address pretty easily. See physicaladdress.com as an example.

Re: Microsoft Defender SmartScreen is hurting independent developers

#139

Post by andrewxdiamond »

ebg13 wrote: post #83
fh973 wrote: post #77

Earlier quoted context omitted.

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.

If you need a business address, it's pretty simple to get.

The main purpose is a paper trail leading the software back to you. If you aren't malicious, it's a few hours task to arrange.

https://www.microsoft.com/en-us/microsoft-365/business-insig...

Re: Microsoft Defender SmartScreen is hurting independent developers

#140

Post by gruez »

kevingadd wrote: post #106
lostmsu wrote: post #78

Earlier quoted context omitted.

I think a major difference here is that LetsEncrypt relies on an already existing third-party authority, that generally has some scrutiny to it: DNS registrars.

Not sure what you mean here, code signing certs are issued by many of the same companies that were issuing SSL certs before LE existed

His point is that with webtrust certificates (what most people think of as "ssl certificates"), it's easy to validate the identity (DNS name), either by sending a email or validating a DNS record. For code signing certificates, they're not issued to DNS names, they're issued to legal entities (natural persons or corporations), which you can't easily validate.
Post reply on HN