Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does my installer get flagged by Windows?

blog.pakkly.com

Post reply on HN
Print view View original

11–20 of 85 posts

Re: Why does my installer get flagged by Windows?

#11

Post by viraptor »

mjevans wrote: post #7
viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Why doesn't Windows (Microsoft) build open source code themselves and sign the source seen, easier to inspect for bad things version?

It's not easy to spot malware, even if you have the source. For example Zoom can capture your screen, start applications, capture mic and camera, and allows remote control of your desktop. Why wouldn't it be blocked as malware even if you could automatically inspect the source?

Re: Why does my installer get flagged by Windows?

#12

Post by laurent123456 »

jrkfkgmfmr wrote: post #4

LPT: put your executable binary on GitHub/GitLab/SourceForge/... These locations are whitelisted since they have a ton of fresh binaries. Malware writers use this trick to bypass SmartScreen. Chrome's equivalent protection also whitelists GitHub/...

I don't think that works, as I had an app hosted on GitHub, a signed one actually, and it was still showing the SmartScreen warning at first. It took a few days to go away.

Re: Why does my installer get flagged by Windows?

#13

Post by ronsor »

jrkfkgmfmr wrote: post #4

LPT: put your executable binary on GitHub/GitLab/SourceForge/... These locations are whitelisted since they have a ton of fresh binaries. Malware writers use this trick to bypass SmartScreen. Chrome's equivalent protection also whitelists GitHub/...

Well that's actually pretty concerning, and it only shows how broken these "security" "features" really are.

Re: Why does my installer get flagged by Windows?

#14

Post by traceroute66 »

jhurliman wrote: post #5
viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.

> Putting a human in the loop for our otherwise fully automated release process is a non-starter.

I don't follow.

The purpose of storing keys in hardware is to irreversibly protect the key.

If you then wish to be silly and hardcode the PIN to the hardware in your release scripts, then that is your prerogative.

If its the cost of an HSM you're alluding to, even that is a non-issue with a Yubikey or Nitrokey.

Re: Why does my installer get flagged by Windows?

#15

Post by inspector-g »

viraptor wrote: post #9
jhurliman wrote: post #5

Earlier quoted context omitted.

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.

Sounds like the hardware key requires a pin, but not physical presence (i.e. not a button touch), so it can be automated https://stackoverflow.com/questions/17927895/automate-extend...

One of my clients has strict requirements for an automated build process, and we managed to use an EV code signing cert on a YubiKey w/ PIN - so it’s definitely possible with a little leg work.

After having gone through it, I agree with other posts that the main annoyance is the verification process and weeks of delays/back-and-forth. That, and the inconvenience of now having a single point of failure in the build process (unless multiple certs are purchased).

Re: Why does my installer get flagged by Windows?

#16

Post by sixothree »

viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Regular code signing cert is often good enough.

Re: Why does my installer get flagged by Windows?

#17

Post by flohofwoe »

ronsor wrote: post #13
jrkfkgmfmr wrote: post #4

LPT: put your executable binary on GitHub/GitLab/SourceForge/... These locations are whitelisted since they have a ton of fresh binaries. Malware writers use this trick to bypass SmartScreen. Chrome's equivalent protection also whitelists GitHub/...

Well that's actually pretty concerning, and it only shows how broken these "security" "features" really are.

No, this definitely doesn't work, random installers and executables downloaded from github.com definitely show the SmartScreen popup.

Re: Why does my installer get flagged by Windows?

#18

Post by jussij »

codeflo wrote: post #3

And that’s before Windows Defender falsely identifies your executable as a random threat and moves it to quarantine without asking. Who do you have to bribe to prevent that?

This does seem to happen far too many times than it should and it can get frustrating.

Over the period of several years this happened to me on at least half a dozen occasions and recently in a two week period it happened three times.

Fortunately, in my experience this has always been fairly easy to fix, as it just requires submitting a false threat report to Microsoft Defender:

https://www.microsoft.com/en-us/wdsi/filesubmission

Each time this happens I just copy my stock standard false report into the fields of that link and within 24 hours Windows Defender is updated.

Re: Why does my installer get flagged by Windows?

#19

Post by AceJohnny2 »

codeflo wrote: post #3

And that’s before Windows Defender falsely identifies your executable as a random threat and moves it to quarantine without asking. Who do you have to bribe to prevent that?

Reminds me of a Coding Horror (?) story where a client kept asking the developer to have their app window be on top (most visible.) Poor developer kept trying to explain that whatever method they used to be on top, anyone else could use to be also on top of their app.

Anyways, there is no general heuristic to distinguish a good actor trying to prove their legitimacy from a bad actor trying to fake legitimacy. This is the essence of parasitism.

Re: Why does my installer get flagged by Windows?

#20

Post by jrockway »

flohofwoe wrote: post #17
ronsor wrote: post #13

Earlier quoted context omitted.

Well that's actually pretty concerning, and it only shows how broken these "security" "features" really are.

No, this definitely doesn't work, random installers and executables downloaded from github.com definitely show the SmartScreen popup.

That's my experience as well. I think that after enough people install something, Microsoft starts trusting it, so it's usually fine for a major release of a popular package. Nightly builds of less popular packages? I always get the popups. (Although oddly, not on any of my projects that I release Windows binaries for...)
Post reply on HN