Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

181–190 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#181

Post by sireat »

This was a problem already a few years ago.

I was working for mid-level corp writing a C# Windows program that would be used by a few hundred people tops.

Even after going through the signing process, there were still false positives from some major anti-virus vendors.

I had to submit and resubmit to multiple vendors to get the program off the false-positives. Some smaller vendors still triggered.

Microsoft Defender was one of those that I had trouble with even after the signing.

So if you write software for a smaller audience you are going to get screwed.

Re: Microsoft Defender SmartScreen is hurting independent developers

#182

Post by Asooka »

umvi wrote: post #49
ebg13 wrote: post #42

Application signing is a mafia protection racket, plain and simple. If you aren't signed by an "authority", every user is told by default automatically that your code is unsafe until you pay money. It is 100% analogous to thugs walking into your store saying "It would be a real shame if something were to happen to scare people away." The message is "We Protected You" and "Unsafe". WHY? Because "WE don't recognize" it…

First they came for the iOS developers, and I did not speak out, because I wasn't an iOS developer. Then they came for the Windows developers, and I did not speak out, because I wasn't a Windows developer... I sure wish I could distribute the software I write without paying some rent-collector (at least) $100 for the privilege.

Yea, I did not speak out. I yelled. But the opposition shouted even louder.

Just butting heads doesn't seem to be getting us any results, there are probably better ways to achieve fairness, even if it is not exactly in the form we want (e.g. popup for every program instead of just unsafe ones).

Re: Microsoft Defender SmartScreen is hurting independent developers

#183

Post by repiret »

colde wrote: post #155
repiret wrote: post #153

I call BS. This might be hurting some hobbyist projects, but anybody who earns their living publishing software, and gets even a small amount of those earnings from Windows apps, can afford $100/year for a code signing certificate. There are a lot of people trying really hard to trick users into installing software they don't want. There's big money in it. Authenticode strikes me as an entirely reasonable step to pro…

But why even require payment for these certificates, since Microsoft according to the article doesn't actually place any value on the certificate itself. You still have to build up reputation separately. In that case, it seems entirely unnecessary to require a paid certificate.

Because it costs money to do the identify verification? Its not like a DV certificate where the volume is very high, and the verification isn't hard to automate.

I paid $400/yr for my employers first Authenticode certificate back when they were a new thing and you could only get them from Verisign. Now there's a handful of providers and competition has brought the price down, but the volume is lower than DV certs, and verification is harder, so the prices won't go down to zero.

Why do identity verification at all, you could ask? A reasonable question; if all I need to start earning reputation is a private key, the costs could go to zero. But letting the scammers make as many identities as they like at no cost changes the prior on a previously unseen identity. It seems MS isn't granting a very strong prior anyway though, so... my argument certainly is weak here.

Re: Microsoft Defender SmartScreen is hurting independent developers

#184

Post by paulryanrogers »

microtonal wrote: post #58
umvi wrote: post #49

Earlier quoted context omitted.

First they came for the iOS developers, and I did not speak out, because I wasn't an iOS developer. Then they came for the Windows developers, and I did not speak out, because I wasn't a Windows developer... I sure wish I could distribute the software I write without paying some rent-collector (at least) $100 for the privilege.

The problem isn't the rent. It may be an inconvenience for an indie developer, but to Microsoft, Apple, etc. the cost of a yearly developer account is peanuts. They are not doing it hoping to make excessive amounts of money. Even if Apple has a million developers paying $100, $100M is barely a blip on their radar. It is all about control. They get to decide whose software gets to run with and whose without annoyances…

Then why not instead charge a nominal amount like $5? Chrome's extension store does that.

My guess is the amount significantly reduces the volume of malware

Re: Microsoft Defender SmartScreen is hurting independent developers

#185

Post by jiggawatts »

haolez wrote: post #120
ebg13 wrote: post #83

Earlier quoted context omitted.

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.

This is in line with my experience. I've worked with cybersecurity in the past and the "attackers" used to be huge black hat companies that had much more money and power than all white hat companies combined. We joked that only the bad guys went to work using suits, since they are very powerful and well organized :)

I know there's a smiley in your comment, but this is a now a very genuine issue, and working in cybersecurity I feel helpless to do anything about the situation.

My biggest worry is the endless "telemetry", "customer experience feedback", "licensing", "opt-out", "tracing", "quality improvement programs", etc. On and on. There are now a thousand hooks into every data centre by just about every vendor involved. Every one of them is exfiltrating information. Every one of them is a data leak waiting to happen. Every one of them could take control at any time.

Huawei isn't doing anything different. The western governments just don't like it that they're copying them.

Re: Microsoft Defender SmartScreen is hurting independent developers

#186

Post by Mindwipe »

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation?

Decentralise the signing authority so there are multiple different independent sources and they lose editorial control and monopoly pricing.

Re: Microsoft Defender SmartScreen is hurting independent developers

#187

Post by wronex »

Please note that EV code signing certificates are not the magic bullet they first appear. SmartScreen is reputation based. An EV code signing certificate does not grant immediate access. You will have to build reputation regardless.

There is no pay to win solution. I've learnt this the hard way.

You can however place the executable in a Zip archive to bypass SmartScreen. An unzipped file won't bear the mark of the web.

Re: Microsoft Defender SmartScreen is hurting independent developers

#188

Post by Avamander »

missedthecue wrote: post #137
vanilla-almond wrote: post #3

Another tale from a developer on their experience getting a code signing certificate from a certificate authority: https://twitter.com/hanspagel/status/1262317935898566658

When I tried to get one for a project I was working on, it was a horrible convoluted hell. They needed all kinds of things scanned and sent to them. They wanted 2 government IDs, 2 financial documents and 2 non-financial documents. Everything had to be notarized. I had to get my financial documents notarized on a different day than the other documents, and had to have a different notary do those. They would not accep…

> There has got to be an easier way to verify someone is in fact a human.

Yeah, there is, digital signatures. Estonia started with it's digital signatures back in early 2000s, a physical signature is practically considered caveman-tier tech. Just recently the EU created the eIDAS regulation.

I really can't predict how long it'll take for the US to catch up though :/

Re: Microsoft Defender SmartScreen is hurting independent developers

#189

Post by Zak »

gruez wrote: post #140
kevingadd wrote: post #106

Earlier quoted context omitted.

Not sure what you mean here, code signing certs are issued by many of the same companies that were issuing SSL certs before LE existed

His point is that with webtrust certificates (what most people think of as "ssl certificates"), it's easy to validate the identity (DNS name), either by sending a email or validating a DNS record. For code signing certificates, they're not issued to DNS names, they're issued to legal entities (natural persons or corporations), which you can't easily validate.

Code signing certificates could be issued to domain names, and that might provide a lower bar to clear while still offering a good way to establish a reputation.

Re: Microsoft Defender SmartScreen is hurting independent developers

#190

Post by mopsi »

captn3m0 wrote: post #128
mkup wrote: post #91

Earlier quoted context omitted.

Microsoft can give out free code-signing certificates like LetsEncrypt, but bind publisher reputation to the domain name, rather than to a particular public key or certificate. In such way, malware makers won't be able to build up enough reputation, because they will have to switch domain names often (and legit software publishers won't be subjects to extortion by Code Signing CAs). Regarding domain expiry problem, t…

This enforces a "developers-must-own-and-continue-to-own-a-domain". Not saying that's bad, but it needs to be considered. for eg A lot of software these days is built and served entirely from GitHub. You could even end up re-using domain-name-signals from existing spam datasets (whois, hosting provider, age etc).

> A lot of software these days is built and served entirely from GitHub.

The identity could also be tied to Github accounts, among other options.

Post reply on HN