Microsoft Defender SmartScreen is hurting independent developers

Post by thefounder » Wed, Jun 03, 2020, 9:17 AM UTC

duskwuff wrote: post #161

thefounder wrote: post #127

Look at this from anither angle: on MacOS it is worse. You can "buy" certificates/approval only from Apple. If Apple doesn't like you, you are screwed!

OTOH: On macOS, you pay $100/yr and you're set -- any apps you notarize will launch with a simple confirmation dialog. On Windows, you can spend hundreds of dollars on a security certificate and still get blocked by SmartScreen and/or antivirus software. I'm not aware of any situations where Apple has declined to offer a developer certificate to a developer, outside of situations where they are legally barred from do…

Post by donmcronald » Wed, Jun 03, 2020, 10:07 AM UTC

captn3m0 wrote: post #128

mkup wrote: post #91

Earlier quoted context omitted.

Microsoft can give out free code-signing certificates like LetsEncrypt, but bind publisher reputation to the domain name, rather than to a particular public key or certificate. In such way, malware makers won't be able to build up enough reputation, because they will have to switch domain names often (and legit software publishers won't be subjects to extortion by Code Signing CAs). Regarding domain expiry problem, t…

This enforces a "developers-must-own-and-continue-to-own-a-domain". Not saying that's bad, but it needs to be considered. for eg A lot of software these days is built and served entirely from GitHub. You could even end up re-using domain-name-signals from existing spam datasets (whois, hosting provider, age etc).

Post by donmcronald » Wed, Jun 03, 2020, 10:17 AM UTC

Avamander wrote: post #57

gregmac wrote: post #44

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs…

> Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs IMO that would still be good. This would help protect against dangerous middlemen, all those massive sites containing thousands of pieces of software, many with added ad- or other badware. If CCleaner (just an random example) could sign their executables for free, then the…

Post by donmcronald » Wed, Jun 03, 2020, 10:49 AM UTC

Zak wrote: post #189

gruez wrote: post #140

Earlier quoted context omitted.

His point is that with webtrust certificates (what most people think of as "ssl certificates"), it's easy to validate the identity (DNS name), either by sending a email or validating a DNS record. For code signing certificates, they're not issued to DNS names, they're issued to legal entities (natural persons or corporations), which you can't easily validate.

Code signing certificates could be issued to domain names, and that might provide a lower bar to clear while still offering a good way to establish a reputation.

Post by donmcronald » Wed, Jun 03, 2020, 11:12 AM UTC

wvenable wrote: post #65

I developed some absolutely free Windows software as a hobby. I specifically didn't want to change for it because then it's a job. Smartscreen was definitely a problem; end users were absolutely afraid of my software. Eventually a user who was also software developer offered to sign the binaries for me with his certificate and that's how I've operated since.