Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

191–200 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#191

Post by the8472 »

echelon wrote: post #13

More walled gardens. Hooray. This is why we need WASM and web-first development. If the platforms won't empower us to develop and distribute without levying their tax, we need to take our business back to the open web and spend our money on making it the best platform. Besides, it's a nightmare to have to develop for every single platform when the web is universal. Platforms should pay the cost of making things work…

web-first means you don't have an immutable application on your machine anymore, it's always loaded from a server on every use. They can change their terms at any time and if you granted them access to a directory tree via the fileystem API they can change the code under your nose and start exfiltrating those files.

Native applications can be forced to run without network access with a single command (e.g. firejail or unshare). The web is always-online.

Re: Microsoft Defender SmartScreen is hurting independent developers

#192

Post by the8472 »

dzonga wrote: post #34

walled gardens ever increasing assault on independent developers never stops. seems microsoft is following Apple's trend of shitting on indies. my take is folks develop your apps to be browser based, if you can. if we can have a browser app, like Figma. a lot of apps, could do. the ones that need to deal with os n files etc, might be non-starter. take your talents to open platforms.

If hypothetically everyone moved to the web then this very same game would again be played by browser vendors. Some browser APIs only work on secure sites (e.g. service workers, EME) and they could start blacklisting specific certificates the same way.

Want to use web payments API? Nope, sorry, your DV certificate doesn't look trustworthy enough, maybe you should get an EV certificate.

Re: Microsoft Defender SmartScreen is hurting independent developers

#193

Post by fomine3 »

Wowfunhappy wrote: post #45

At least for standard apps, the user can bypass the warning. For drivers, it gets much worse. On 64 bit versions of Windows, there is no way for me to permanently allow unsigned drivers. Every time I want to install an unsigned driver, I have to reboot my computer while holding down shift, select advanced startup options, and then hit "7" on a USB keyboard which I lug out of the closet because my Bluetooth keyboard w…

Only accepting signed drivers is fine trade off for its power IMO.

Re: Microsoft Defender SmartScreen is hurting independent developers

#194

Post by tobias3 »

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

For open source apps: Perhaps have a build service (Azure+github) that builds the software from source, then automatically signs it. Perhaps have some kind of application + manual review + requirements (like Github 2FA) process. Scanning for malicious source code would help a small bit as well.

For individuals: Some countries have an electronic identity system (eID), that would allow verification of name + address when code signing while being as secure/more secure than the usb sticks one gets for an EV certificate + the EV address/identity verification process. Because there is no standard this would be a lot of per-country work. And some countries don't have a (good) eID system (or an ID system at all). I only know the technical details of the German one and that one would work.

For businesses: EV certificates shouldn't be too much of a cost there. Though I am annoyed by the lack of competition driving the prices down in this area. Maybe make it easier for new authorities to enter the market?

Re: Microsoft Defender SmartScreen is hurting independent developers

#195

Post by fomine3 »

fh973 wrote: post #87
falcolas wrote: post #76

Earlier quoted context omitted.

Funny how Let’s Encrypt is so popular because it doesn’t inconvenience people, and as a result more websites than ever have been secured, to the betterment of society.

There is a huge difference of what kind of identity is established: Let's Encrypt tells you basically that you are actually talking to the right server, whereas EV certs for signing binaries tell you which company that actually exists in the real world owns the certificate.

But no one cares DV/OV/EV differences for web certs.

Re: Microsoft Defender SmartScreen is hurting independent developers

#196

Post by bob1029 »

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

What did we do before we needed corporations to tell us what is safe and unsafe for consumption? Even as late as 2010 I cannot recall some e-nanny telling me that I downloaded a naughty executable image. I do not recall anyone having a life-altering problem due to lack of such a system, but I only know so many people.

Any way you slice this it's more about profit than it is about security. There is no amount of locking-down of Windows that will prevent my friends and family from figuring out how to completely fuck up the machine anyways and everyone involved knows it.

We were literally just talking about how awesome it would be to dumpster Apple's iOS ecosystem in favor of a .NET/Surface ecosystem, but if its going to be the same enterprise signing certificate hell, then Microsoft can fuck directly off too. I am so tired of this shit. We have spent the last 2 weeks fighting Apple certificate nonsense on behalf of several of our customers.

Apple, Microsoft, and others who would force code signing identities on developers: Kindly fuck off with your nonsense. We would like to get back to writing code and delivering excellent customer experiences. Trust can be built in many other ways. You are not the sole arbiters of trust. I would much more likely follow advice from a green username on HN than I would your smartscreen technology or any ridiculous certificate chain backing it.

Re: Microsoft Defender SmartScreen is hurting independent developers

#197

Post by fomine3 »

repiret wrote: post #177
voltagex_ wrote: post #172

Earlier quoted context omitted.

$100 USD

Yes. I'll accept that thats a lot of money in some places of the world, but thats less than half a day of time for a skilled Windows developer no matter where they live.

So we need to become skilled Windows developer before buy a certificate.

Re: Microsoft Defender SmartScreen is hurting independent developers

#198

Post by fomine3 »

diego_moita wrote: post #22

> The digital signature racket > The price range is wide but a certificate only valid for a year will typically go for about $100. This is hypocrisy, smells like Apple-fanboy trolling. MS stimulates competition on the code signing certificates and it is free to deploy through their appstore. And you can bypass Smartscreen right from the warning. Certificates cost $59.00 at codesigncert[0], not "about $100.00". Establ…

Agreed. It's not good that only Apple can sell cheap certificates.

Re: Microsoft Defender SmartScreen is hurting independent developers

#199

Post by realusername »

repiret wrote: post #153

I call BS. This might be hurting some hobbyist projects, but anybody who earns their living publishing software, and gets even a small amount of those earnings from Windows apps, can afford $100/year for a code signing certificate. There are a lot of people trying really hard to trick users into installing software they don't want. There's big money in it. Authenticode strikes me as an entirely reasonable step to pro…

> There are a lot of people trying really hard to trick users into installing software they don't want. There's big money in it. Authenticode strikes me as an entirely reasonable step to provide more signal to the systems trying to identify and block crapware.

Maybe that should be up to the machine owners to decide what to install themselves (crazy idea I know).

Post reply on HN