Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

141–150 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#141

Post by lodovic »

microtonal wrote: post #50
echelon wrote: post #13

More walled gardens. Hooray. This is why we need WASM and web-first development. If the platforms won't empower us to develop and distribute without levying their tax, we need to take our business back to the open web and spend our money on making it the best platform. Besides, it's a nightmare to have to develop for every single platform when the web is universal. Platforms should pay the cost of making things work…

This is why we need WASM and web-first development. This is only going to make things worse. If everything is a web application, why would users even need access to their hardware or be able to modify their operating system? Boot from an locked bootloader that only loads a FAANG-signed shim OS, that only loads a FAANG-signed web browser. Next, disallow extensions and ad blockers and we are in the brave new web world…

Interesting. How are we going to block annoying content if it is implemented in WASM?

Re: Microsoft Defender SmartScreen is hurting independent developers

#142

Post by Wowfunhappy »

captn3m0 wrote: post #128
mkup wrote: post #91

Earlier quoted context omitted.

Microsoft can give out free code-signing certificates like LetsEncrypt, but bind publisher reputation to the domain name, rather than to a particular public key or certificate. In such way, malware makers won't be able to build up enough reputation, because they will have to switch domain names often (and legit software publishers won't be subjects to extortion by Code Signing CAs). Regarding domain expiry problem, t…

This enforces a "developers-must-own-and-continue-to-own-a-domain". Not saying that's bad, but it needs to be considered. for eg A lot of software these days is built and served entirely from GitHub. You could even end up re-using domain-name-signals from existing spam datasets (whois, hosting provider, age etc).

> This enforces a "developers-must-own-and-continue-to-own-a-domain". Not saying that's bad

I'll come out and say it's bad... but also much better than the current situation. So as a compromise I'm all for it!

Re: Microsoft Defender SmartScreen is hurting independent developers

#143

Post by ripley12 »

WorldMaker wrote: post #53
cptskippy wrote: post #23

Earlier quoted context omitted.

Honestly I am all for sandboxing by default and scary prompts for anything that doesn't subject itself to strict sandboxing or that tries to break out of it. That doesn't mean apps necessarily have to come from a MS curated store either, just that by default the run in a sandboxed context with access to dick squat on my system. I absolutely hate when I install something like Adobe Acrobat and it installs 18 schedule…

MSIX tries to be exactly that. It supports the gamut of Win32 so long as they can be minimally sandboxed. Win32 apps in MSIX still have access to everything and can't be entirely trusted, but the installer will warn you about that a lot less "scarily" than the SmartScreen Defender prompt this author doesn't like. MSIX can be sideloaded by default in every supported version of Windows (in addition to or rather than St…

> MSIX can be sideloaded by default in every supported version of Windows

Is that true? I thought MSIX sideloading was only enabled by default in the recent Win10 2004 release (better late than never!). https://www.windowslatest.com/2019/08/12/windows-10-20h1-imp...

Re: Microsoft Defender SmartScreen is hurting independent developers

#144

Post by blablabla123 »

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

> What's the equivalent to the "URL bar" for software? What's the equivalent to the ACME domain validation challenge?

It's quite ironic that JavaScript is practically a native language on Windows since Windows 8. Either it's indeed not possible to use LetsEncrypt for that or they marketed it wrong to developers.

I'm amazed how MS is often the first one to push out new Desktop technology a decade before everyone else (HTML on the desktop, AJAX) but it's usually others that take full advantage of those on other platforms...

Re: Microsoft Defender SmartScreen is hurting independent developers

#145

Post by netflixandkill »

notyourday wrote: post #131
driverdan wrote: post #112

Earlier quoted context omitted.

As someone who used to make fake IDs it would be very easy to pass EV checks. It's like putting a padlock on a gate. Anyone who wants to get past it can easily do so.

I have a hard time believing this. Based on my experience, a part of the EV check was checking of the business entity with the state and sending snail mail to the address of record. Since our registered address was a law firm, I had to go through all kinds of hoops to get that letter as it contained the string needed to proceed to the next step in the EV verification.

digressing a bit, that's believable but my registered agent (a specialized law firm) just scans and uploads any mail to my account on their portal. It's not a problem most businesses spend much time on but you can probably find one that lives in this century. If I'm paying them a tiny annual retainer it's the least they can do and has already saved me a lot of tax compliance hassle being able to pull old docs that were handled by someone else.

If you were deliberately trying to set up a few shells for obfuscation it would not be hard, particularly if you had some means of buying fake IDs.

Re: Microsoft Defender SmartScreen is hurting independent developers

#146

Post by notyourday »

Nextgrid wrote: post #135
notyourday wrote: post #131

Earlier quoted context omitted.

I have a hard time believing this. Based on my experience, a part of the EV check was checking of the business entity with the state and sending snail mail to the address of record. Since our registered address was a law firm, I had to go through all kinds of hoops to get that letter as it contained the string needed to proceed to the next step in the EV verification.

You can recruit a clueless person to be a “virtual assistant” or similar, give them some random admin tasks (to make it feel legitimate) before sending the letter to their address and asking them to read/scan the contents for you. A similar approach is successfully used by scammers to recruit money mules.

You have to be first registered with the state and the feds (IRS) as a business which creates all kinds of legal obligations and paperwork.

Re: Microsoft Defender SmartScreen is hurting independent developers

#147

Post by Avamander »

411111111111111 wrote: post #114
Avamander wrote: post #57

Earlier quoted context omitted.

> Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs IMO that would still be good. This would help protect against dangerous middlemen, all those massive sites containing thousands of pieces of software, many with added ad- or other badware. If CCleaner (just an random example) could sign their executables for free, then the…

> This would help protect against dangerous middlemen but if everyone can get their certificate, they can always just sign it with their own...

Yes, true. But it would be an additional hurdle and any weirdness like that is visible. Plus MS or AV vendors could blacklist actual signers that misbehave.

Re: Microsoft Defender SmartScreen is hurting independent developers

#148

Post by sequence7 »

This is really hurting Microsoft's ecosystem, I'm trying to add the latest version of QuickLook [0] to the winget package manager at the moment but because the msi installer isn't signed my pull request is doomed to failure[1].

If Microsoft want Windows to be an awesome developer platform this kind of friction with the tooling helps no-one.

[0] https://github.com/QL-Win/QuickLook [1] https://github.com/microsoft/winget-pkgs/pull/1241

Re: Microsoft Defender SmartScreen is hurting independent developers

#149

Post by recursive »

kevingadd wrote: post #113
recursive wrote: post #28

Earlier quoted context omitted.

That may be, but not because of a barrier to entry. (the wall around the garden)

The barrier to entry for integrating with the web ecosystem is way higher than native. I can interop trivially with basically any native app on my machine, meanwhile even basic tasks like 'export my data from this web service' are often difficult or impossible because vendors don't care. If you are building a custom product from scratch with no need to integrate with users' existing data and services, the barrier to…

> I can interop trivially with basically any native app on my machine.

You must have different native apps than most users.

In any case, there's nothing special about WASM and DOM that makes it less interoperable than native stuff.

Re: Microsoft Defender SmartScreen is hurting independent developers

#150

Post by filoleg »

fenwick67 wrote: post #43
dzonga wrote: post #34

walled gardens ever increasing assault on independent developers never stops. seems microsoft is following Apple's trend of shitting on indies. my take is folks develop your apps to be browser based, if you can. if we can have a browser app, like Figma. a lot of apps, could do. the ones that need to deal with os n files etc, might be non-starter. take your talents to open platforms.

I was under the impression Figma was an executable, not a web app.

it is a web app. You can run it fully in the browser. Local executable is just an Electron app iirc. I don't have it install on my work machine, but I frequently access and manipulate Figma files from Chrome just fine.
Post reply on HN