Also: Buy a the longest code signing cert you can. Reputation is acquired at cert and build level; updates signed with same cert are cleared much much faster. Cert reputation is lost when it expires, meaning back to square one to sign updates.
Why does my installer get flagged by Windows?
21–30 of 85 posts
Re: Why does my installer get flagged by Windows?
#22It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…
Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.
Worse still, the SafeNet software that my cert vendor recommends using (to interact with the hardware key) doesn't even allow use of Remote Desktop sessions!
It somehow detects if you're in an RDP session, and shows that there are no hardware tokens attached if that's the case. No message or warning whatsoever. My only Windows PC is headless and I lost several hours trying to debug this.
The entire EV cert process is such an outrage. My cert vendor advertised that the validation process would take 2-3 business days if all docs were in order, DUNS info correct, etc. I spent a lot of time ahead of the order ensuring the docs were indeed in order, and the process still inexplicably took 9 business days.
Re: Why does my installer get flagged by Windows?
#23And that’s before Windows Defender falsely identifies your executable as a random threat and moves it to quarantine without asking. Who do you have to bribe to prevent that?
>Who do you have to bribe to prevent that?
It's covered in the article: buy an EV code signing certificate.
Re: Why does my installer get flagged by Windows?
#24Same thing is happening to the web: I put compiled executables in a zip on my website and Chrome flags them as "unknown / untrusted" with a few hoops to download and run it. I understand the advantages of protecting naive users from malware but this is really going to hurt small / independent software developers.
Re: Why does my installer get flagged by Windows?
#25Earlier quoted context omitted.
Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.
Worse still, the SafeNet software that my cert vendor recommends using (to interact with the hardware key) doesn't even allow use of Remote Desktop sessions! It somehow detects if you're in an RDP session, and shows that there are no hardware tokens attached if that's the case. No message or warning whatsoever. My only Windows PC is headless and I lost several hours trying to debug this. The entire EV cert process is…
Maybe try something like TeamViewer since rdp virtualizes the display adapter and likely other things
Re: Why does my installer get flagged by Windows?
#26Earlier quoted context omitted.
Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.
Worse still, the SafeNet software that my cert vendor recommends using (to interact with the hardware key) doesn't even allow use of Remote Desktop sessions! It somehow detects if you're in an RDP session, and shows that there are no hardware tokens attached if that's the case. No message or warning whatsoever. My only Windows PC is headless and I lost several hours trying to debug this. The entire EV cert process is…
One way around SafeNet is to run the builder in a VM, then RDP into the host.
Re: Why does my installer get flagged by Windows?
#27Earlier quoted context omitted.
Worse still, the SafeNet software that my cert vendor recommends using (to interact with the hardware key) doesn't even allow use of Remote Desktop sessions! It somehow detects if you're in an RDP session, and shows that there are no hardware tokens attached if that's the case. No message or warning whatsoever. My only Windows PC is headless and I lost several hours trying to debug this. The entire EV cert process is…
Maybe try something like TeamViewer since rdp virtualizes the display adapter and likely other things
It's not about virtualisation. RDP sessions are actually marked as remote login sessions. The login source can be checked easily in each app. (or just run `net session`)
If TeamViewer acts on an already logged-in local session, it should work well.
Re: Why does my installer get flagged by Windows?
#28And that’s before Windows Defender falsely identifies your executable as a random threat and moves it to quarantine without asking. Who do you have to bribe to prevent that?
>Who do you have to bribe to prevent that? It's covered in the article: buy an EV code signing certificate.
These are different things. SmartScreen can be solved with a certificate. Being classified as a virus/malware is a separate process.
Re: Why does my installer get flagged by Windows?
#29Same thing is happening to the web: I put compiled executables in a zip on my website and Chrome flags them as "unknown / untrusted" with a few hoops to download and run it. I understand the advantages of protecting naive users from malware but this is really going to hurt small / independent software developers.
It also drives them to stores which take a significant financial cut.
Re: Why does my installer get flagged by Windows?
#30Earlier quoted context omitted.
Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.
You can automate code signing using Microsoft azure key vault. I did it last month, no need for a dongle nor a pin number
Also, Microsoft is working on a code signing service called Azure Code Signing where Microsoft issues and manages the certificate and keys and you simply upload binaries/app packages to Azure which does the signing.
As far as I can tell, the video is the only public information on the non-GA service: https://youtu.be/Wi-4WdpKm5E?t=529