Why does my installer get flagged by Windows?

#1

Post by grwtr » Thu, Jul 01, 2021, 8:30 PM UTC

Why does my installer get flagged by Windows?
blog.pakkly.com

Re: Why does my installer get flagged by Windows?

#2

Post by viraptor » Thu, Jul 01, 2021, 10:14 PM UTC

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows the current address B, it's in the file I sent", "please send us a valid ID with address B", (repeat).

But unfortunately that's just a rant. I don't know if there even if a better solution. The money barrier (rather than verification) will stop some opportunistic malware, but big players won't care.

Re: Why does my installer get flagged by Windows?

#3

Post by codeflo » Thu, Jul 01, 2021, 10:22 PM UTC

And that’s before Windows Defender falsely identifies your executable as a random threat and moves it to quarantine without asking. Who do you have to bribe to prevent that?

Re: Why does my installer get flagged by Windows?

#4

Post by jrkfkgmfmr » Thu, Jul 01, 2021, 10:46 PM UTC

LPT: put your executable binary on GitHub/GitLab/SourceForge/... These locations are whitelisted since they have a ton of fresh binaries.

Malware writers use this trick to bypass SmartScreen. Chrome's equivalent protection also whitelists GitHub/...

Re: Why does my installer get flagged by Windows?

#5

Post by jhurliman » Thu, Jul 01, 2021, 10:46 PM UTC

viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.

Re: Why does my installer get flagged by Windows?

#6

Post by mgiannelis » Thu, Jul 01, 2021, 10:49 PM UTC

You can find the answers to these types of technology related questions on websites such as https://www.techbusinessnews.com.au

Re: Why does my installer get flagged by Windows?

#7

Post by mjevans » Thu, Jul 01, 2021, 10:49 PM UTC

viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Why doesn't Windows (Microsoft) build open source code themselves and sign the source seen, easier to inspect for bad things version?

Re: Why does my installer get flagged by Windows?

#8

Post by maille » Thu, Jul 01, 2021, 10:52 PM UTC

jhurliman wrote: post #5

viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.

You can automate code signing using Microsoft azure key vault. I did it last month, no need for a dongle nor a pin number

Re: Why does my installer get flagged by Windows?

#9

Post by viraptor » Thu, Jul 01, 2021, 10:52 PM UTC

jhurliman wrote: post #5

viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.

Sounds like the hardware key requires a pin, but not physical presence (i.e. not a button touch), so it can be automated https://stackoverflow.com/questions/17927895/automate-extend...

Re: Why does my installer get flagged by Windows?

#10

Post by stordoff » Thu, Jul 01, 2021, 10:53 PM UTC

jrkfkgmfmr wrote: post #4

LPT: put your executable binary on GitHub/GitLab/SourceForge/... These locations are whitelisted since they have a ton of fresh binaries. Malware writers use this trick to bypass SmartScreen. Chrome's equivalent protection also whitelists GitHub/...

Not sure this works. Just grabbed a build of WhyNotWin11[1] released 20 hours ago, and I get "Microsoft Defender SmartScreen prevented an unrecognised app from starting. Running this app might put your PC at risk."

[1] https://github.com/rcmaehl/WhyNotWin11 (used for test as I thought I remembered seeing this with a build from earlier this week)