Microsoft Defender SmartScreen is hurting independent developers • Hacker News Board

Re: Microsoft Defender SmartScreen is hurting independent developers

#151

Post by WorldMaker » Tue, Jun 02, 2020, 8:22 PM UTC

ripley12 wrote: post #143

WorldMaker wrote: post #53

Earlier quoted context omitted.

MSIX tries to be exactly that. It supports the gamut of Win32 so long as they can be minimally sandboxed. Win32 apps in MSIX still have access to everything and can't be entirely trusted, but the installer will warn you about that a lot less "scarily" than the SmartScreen Defender prompt this author doesn't like. MSIX can be sideloaded by default in every supported version of Windows (in addition to or rather than St…

> MSIX can be sideloaded by default in every supported version of Windows Is that true? I thought MSIX sideloading was only enabled by default in the recent Win10 2004 release (better late than never!). https://www.windowslatest.com/2019/08/12/windows-10-20h1-imp...

APPX sideloading has been enabled by default since at least the Anniversary Update. Not every MSIX will sideload if just renamed to APPX, but many will (including many Win32 applications). Microsoft has stated that every actively supported Windows 10 feature update from the Anniversary Update forward will receive updates to enable the rest of MSIX and the MSIX file extension, including sideloading.

Re: Microsoft Defender SmartScreen is hurting independent developers

#152

Post by jonathanlydall » Tue, Jun 02, 2020, 8:23 PM UTC

ebg13 wrote: post #67

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking u…

Having gone through the process myself, it’s not trivial.

We first tried through GoDaddy who shouldn’t even offer the service to South Africans because they “required” a photograph of a company director holding a government issued photo identity document with physical address included. There is no such type of document here. We offered affidavits, lawyers letters, but they were unbending.

We then tried and managed to succeed through Digicert. Their process involved a few checks including checking local government mandated company registry and using the telephone number from that registry to phone a director to confirm they were aware of the certificate request.

Bad guys can certainly get this done, but it raises the bar very substantially, and once they’ve burned their credibility of the company the certificate is issued against, they have to use a different company.

Re: Microsoft Defender SmartScreen is hurting independent developers

#153

Post by repiret » Tue, Jun 02, 2020, 8:28 PM UTC

I call BS. This might be hurting some hobbyist projects, but anybody who earns their living publishing software, and gets even a small amount of those earnings from Windows apps, can afford $100/year for a code signing certificate.

There are a lot of people trying really hard to trick users into installing software they don't want. There's big money in it. Authenticode strikes me as an entirely reasonable step to provide more signal to the systems trying to identify and block crapware.

Re: Microsoft Defender SmartScreen is hurting independent developers

#154

Post by kroltan » Tue, Jun 02, 2020, 8:38 PM UTC

kevingadd wrote: post #100

jedberg wrote: post #98

Earlier quoted context omitted.

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Do what Apple does -- allow me as a user to set a setting that allows unsigned code to run, or allows signed but not recognized code to run, but with a warning that it is signed but not recognized. They could also fix their warning screen to better explain that it's not necessarily malware.

Windows already works the way you describe. There's a Developer Mode that relaxes some restrictions and SmartScreen lets you run unsigned code even in its default configuration (you have to click More Info to show the button, which is annoying but hardly unique to Windows - security error bypass in most browsers has been this way for ages)

SmartScreen's current behaviour is more like if browsers pretended HTTP is a security error (It is not. It is just insecure, and labeled as such) and required the same bypass workflow.

Re: Microsoft Defender SmartScreen is hurting independent developers

#155

Post by colde » Tue, Jun 02, 2020, 8:40 PM UTC

repiret wrote: post #153

I call BS. This might be hurting some hobbyist projects, but anybody who earns their living publishing software, and gets even a small amount of those earnings from Windows apps, can afford $100/year for a code signing certificate. There are a lot of people trying really hard to trick users into installing software they don't want. There's big money in it. Authenticode strikes me as an entirely reasonable step to pro…

But why even require payment for these certificates, since Microsoft according to the article doesn't actually place any value on the certificate itself. You still have to build up reputation separately. In that case, it seems entirely unnecessary to require a paid certificate.

Re: Microsoft Defender SmartScreen is hurting independent developers

#156

Post by magicalhippo » Tue, Jun 02, 2020, 8:45 PM UTC

fierarul wrote: post #73

Dear GitHub CEO reading this message on HN: a cool feature would be a GitHub action to sign binaries for free . It's ridiculous that my open source code is hosted on GitHub, the binary is created with an action but I have to pay for a certificate and manually sign it.

I guess since Microsoft through GitHub controls the build process, couldn't they also include the signed source as well as a combined signature?

Idea being that one could, in theory, download the git repo, check out the relevant commit and verify that this was the source code and this was the resulting binary, and that matches the exe file I just downloaded.

Re: Microsoft Defender SmartScreen is hurting independent developers

#157

Post by jimmaswell » Tue, Jun 02, 2020, 8:48 PM UTC

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

It was a better situation when anything would just run. Defender scans for known malware and that should be enough.

Re: Microsoft Defender SmartScreen is hurting independent developers

#158

Post by ilaksh » Tue, Jun 02, 2020, 8:49 PM UTC

This racket and Microsoft's hostility to independent developers (and apparent attempt to force them to use their Windows store?) is one of the reasons that I just can't go along with people who think that Microsoft is a "champion of open source" now or benign actor in the business world. They are fundamentally corrupt and cutthroat.

I recently wiped Windows and loaded up Pop! OS. It works great. And I never get a message saying "this software is suspicious" just because it's not in an official Deb package or something. If I add a PPA or download a binary or whatever I do, there are basic permissions required, but it does not automatically say "this is probably dangerous so I stopped it" just because the distro doesn't recognize the software. That is ridiculous.

Re: Microsoft Defender SmartScreen is hurting independent developers

#159

Post by mceachen » Tue, Jun 02, 2020, 8:55 PM UTC

xoail wrote: post #24

I recently went through this pain for an electron app. Non-EV code sign cert kept throwing SmartScreen warnings for most users. Acquiring an EV cert forced me to register a company and a hefty cert price per year, overall costing nearly $1500. Not to mention overall delay and added costs. Meanwhile my $100/y Apple Dev subscription was enough to package the app and distribute outside App Store. At this point I am fair…

Oof. Next time you need to renew, check the links from the msft authenticode dev website for ev certs. A couple providers are much less than $1500/yr.

Also, when I got my renewal bill for something like $1500/yr for PhotoStructure, I sent an email to their support asking to continue the low original fee, and they agreed.

Re: Microsoft Defender SmartScreen is hurting independent developers

#160

Post by Nextgrid » Tue, Jun 02, 2020, 8:58 PM UTC

notyourday wrote: post #146

Nextgrid wrote: post #135

Earlier quoted context omitted.

You can recruit a clueless person to be a “virtual assistant” or similar, give them some random admin tasks (to make it feel legitimate) before sending the letter to their address and asking them to read/scan the contents for you. A similar approach is successfully used by scammers to recruit money mules.

You have to be first registered with the state and the feds (IRS) as a business which creates all kinds of legal obligations and paperwork.

You're assuming this is in the US; some countries have different requirements and it's much easier to set up a business fraudulently. Not to mention, given the current situation with fraudulent covid-related unemployment/benefit claims in the US I am pretty sure there are ways to set up a business fraudulently in the US too.