Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

211–220 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#211

Post by ebg13 »

close04 wrote: post #180
ebg13 wrote: post #175

Earlier quoted context omitted.

> With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place Exactly. That's why this should just stop. Because it hurts without helping.

> That's why this should just stop So they should stop (discontinue) every measure that can be bypassed by an outfit with this kind of money? That doesn't leave many measures, if any. And it lowers the bar for a successful attack to someone with a couple of hours to spare. SmartScreen prompts are just like any HTTP error in a browser. The cert certifies an identity, that's it. It doesn't magically clean any malware i…

> It helps me verify that the software I use comes from the developer I expected.

Nobody needs to charge money for me to be able to sign my executables with something like PGP.

> The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it.

And yet the message is very clearly "THIS IS UNSAFE" because "WE don't know the guy". It isn't "Don't run"/"Run anyway thanks." It's "DON'T RUN" in BOLD in an eye-catching bright box in a prominent location where buttons go and "(more info)" in body text somewhere else.

Re: Microsoft Defender SmartScreen is hurting independent developers

#212

Post by gorkish »

ameyab wrote: post #203

I am one of the creators of SmartScreen application reputation. SmartScreen is a reputation-based safety feature that allows 'know' downloaded software to run friction-free but interrupts the execution of 'unknow' downloaded software with a 'stranger-danger' warning. SmartScreen application reputation was first launched in IE9 (2010/2011) and then was integrated into Windows (starting with Windows 8 in 2012). It has…

With all due respect, you may have built an effective tool to suppress malware, but I would be more excited had you addressed the complaint in the article.

It remains difficult if not impossible for a brand new developer to coordinate a new launch or for an open source project to release unsigned binaries without triggering SmartScreen's rather opaque and user-hostile reputation block. At first glance, the dialog does not give the user any information that it is even possible to execute the program. Of course it stops malware. It brings the average Windows user to a dead stop!

Based on the number of regular people I help on a daily basis who download completely legitimate, "esoteric, non-very-commonly-downloaded software" I must say that I do not find your arguments very compelling. This tool could have easily remained in your browser where it belongs.

Re: Microsoft Defender SmartScreen is hurting independent developers

#213

Post by Wowfunhappy »

fomine3 wrote: post #193
Wowfunhappy wrote: post #45

At least for standard apps, the user can bypass the warning. For drivers, it gets much worse. On 64 bit versions of Windows, there is no way for me to permanently allow unsigned drivers. Every time I want to install an unsigned driver, I have to reboot my computer while holding down shift, select advanced startup options, and then hit "7" on a USB keyboard which I lug out of the closet because my Bluetooth keyboard w…

Only accepting signed drivers is fine trade off for its power IMO.

Shouldn't I as a user get to make that choice? I put this machine together with my own hands!

And, practically speaking, I need to do it because it's the only way to get certain weird game controllers to work.

Re: Microsoft Defender SmartScreen is hurting independent developers

#214

Post by notyourday »

blackflame7000 wrote: post #174
notyourday wrote: post #146

Earlier quoted context omitted.

You have to be first registered with the state and the feds (IRS) as a business which creates all kinds of legal obligations and paperwork.

You can create shell corporations anonymously where the only thing that ties you to the company is possession of the bearer bonds

That's messing with the taxes. That's the most dangerous kind of enterprise.

Re: Microsoft Defender SmartScreen is hurting independent developers

#215

Post by progfix »

ameyab wrote: post #203

I am one of the creators of SmartScreen application reputation. SmartScreen is a reputation-based safety feature that allows 'know' downloaded software to run friction-free but interrupts the execution of 'unknow' downloaded software with a 'stranger-danger' warning. SmartScreen application reputation was first launched in IE9 (2010/2011) and then was integrated into Windows (starting with Windows 8 in 2012). It has…

> there was some friction.

The friction is still there. Have you read the article?

> When SmartScreen was launched, nearly 7% of all downloads were later detected as malware by AV.

What about the other 93%? The vast majority gets unnecessarily blocked!

Re: Microsoft Defender SmartScreen is hurting independent developers

#216

Post by kevingadd »

recursive wrote: post #149
kevingadd wrote: post #113

Earlier quoted context omitted.

The barrier to entry for integrating with the web ecosystem is way higher than native. I can interop trivially with basically any native app on my machine, meanwhile even basic tasks like 'export my data from this web service' are often difficult or impossible because vendors don't care. If you are building a custom product from scratch with no need to integrate with users' existing data and services, the barrier to…

> I can interop trivially with basically any native app on my machine. You must have different native apps than most users. In any case, there's nothing special about WASM and DOM that makes it less interoperable than native stuff.

The problem isn't WASM and DOM, it's that in the web environment because the storage and expressiveness are so limited most of your data lives on a third-party server and now you have to integrate with that.

My Outlook and Thunderbird inboxes are files on my local disk, so if I'm determined enough I can dig through those files with custom software. If I want to process my gmails no amount of time in a hex editor will help me because that data lives on a server somewhere. In practice, Thunderbird acts as my interop tool here, because the developers of that program did the work to keep up with whatever method was offered to pull content out of gmail. In this case there are standardized APIs (network protocols) for talking to mail servers, and lots of software that implements those. What's the equivalent if you want to do this in a webapp? Is there a common API that I can use in my webapp to access a user's gmail, apple mail, outlook mail, etc?

In practice you need to do 1-off integrations with almost every given web service a customer's data might live on, and some of those services don't have any APIs so it's screen-scraping or nothing. It's as if every user's photos were stored in a mix of 50 different custom image file formats.

Re: Microsoft Defender SmartScreen is hurting independent developers

#217

Post by close04 »

ebg13 wrote: post #211
close04 wrote: post #180

Earlier quoted context omitted.

> That's why this should just stop So they should stop (discontinue) every measure that can be bypassed by an outfit with this kind of money? That doesn't leave many measures, if any. And it lowers the bar for a successful attack to someone with a couple of hours to spare. SmartScreen prompts are just like any HTTP error in a browser. The cert certifies an identity, that's it. It doesn't magically clean any malware i…

> It helps me verify that the software I use comes from the developer I expected. Nobody needs to charge money for me to be able to sign my executables with something like PGP. > The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it. And yet the message is very clearly "THIS IS UNSAFE" because "WE don't know the guy". It isn'…

> Nobody needs to charge money

Your initial argument was against SmartScreen, not against paying. Now it's that things should be free. A cert costs because it gives you access to an already established infrastructure, integrated with everything, where you can easily verify the identify being certified.

Business opportunity for you: set up a similar infra for PGP but free. Something that can be integrated with an OS and can instantly allow me to see what a certificate would. Then make sure your infra don't become the point of failure. You can also implement a reputation system where a new developer gets a warning but one that's not intrusive, almost easy to miss... I will gladly use it (and I'm sure OS makers will too once you prove your solution is at least as solid as PKI) because I want the functionality, not the particular implementation.

> because "WE don't know the guy"

I don't know the guy either because there's not kind of identification attached to the package. A clear identification and reputation systems definitely help. Both of these are widely used on the internet today because it's pretty much the only way anyone ever came up with to discourage offenders. I will say it again and again: it raises the bar for a successful attack.

> It isn't "Don't run"/"Run anyway thanks." It's "DON'T RUN"

Which is almost identical to a browser security warning. It stands to reason that protecting your own machine should have an even more prominent message.

If you jump from one line of argumentation to another you'll never make a point. And your "solution" was to suggest that any security measure which can be bypassed by someone with millions of dollars to spend on this should not be implemented at all. Which is not even worthy of discussion.

Re: Microsoft Defender SmartScreen is hurting independent developers

#218

Post by pjmlp »

snuxoll wrote: post #99
WorldMaker wrote: post #60

Earlier quoted context omitted.

Win32 MSIX packages are minimally sandboxed by default. Mostly just in that it virtualizes some file system and Registry changes to ensure the package is clean to uninstall. It doesn't stop Win32 apps from doing crazy Win32 things (unfortunately), but it's still a step up from MSI/EXE installs in general.

MSIX only enforces a sandbox if an application doesn’t elect to use the restricted capabilities that allow it to run without. File system and registry virtualization can be disabled quite easily with a few lines in the package manifest, as well as a host of other isolation features. This is a good thing, and it makes MSIX a usable packaging format for pretty much any application under the sun - but nobody should assu…

Now with Project Reunion making it official that both worlds are getting merged, I look forward that with time the minimal Win32 sandbox acquires full sandboxing capabilities.

I see current MSIX limitations for Win32 just as means to incrementally steer developers into it, while not introducing too many breaking changes (as WinRT happened to be).

Re: Microsoft Defender SmartScreen is hurting independent developers

#219

Post by pjmlp »

echelon wrote: post #13

More walled gardens. Hooray. This is why we need WASM and web-first development. If the platforms won't empower us to develop and distribute without levying their tax, we need to take our business back to the open web and spend our money on making it the best platform. Besides, it's a nightmare to have to develop for every single platform when the web is universal. Platforms should pay the cost of making things work…

Web makes your OS irrelevant, the browser is the VM, it can even be running bare metal for what I care.

Best way to kill all alternative OSes.

Re: Microsoft Defender SmartScreen is hurting independent developers

#220

Post by [deleted] »

makomk wrote: post #129
ebg13 wrote: post #95

Earlier quoted context omitted.

You don't get to handwave away a clear fallacy with "ok but you get the point". _My_ point is that the point is false, not that the example is bad. If Bonzi Buddy can just buy their way into your computer, then this does not save you. From anything. Because real malicious actors like Bonzi Buddy can just buy their way in!

I don't think this is just a hypothetical either; if I remember rightly, a lot of the really obnoxoius unwanted software from that era was signed with valid, purchased signing certificates in order to encourage people to install it via ActiveX.

[deleted]
Post reply on HN