Why does my installer get flagged by Windows?

Post by innocenat » Fri, Jul 02, 2021, 1:52 AM UTC

sixothree wrote: post #16

viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Regular code signing cert is often good enough.

Post by bluedino » Fri, Jul 02, 2021, 2:05 AM UTC

AceJohnny2 wrote: post #19

codeflo wrote: post #3

And that’s before Windows Defender falsely identifies your executable as a random threat and moves it to quarantine without asking. Who do you have to bribe to prevent that?

Reminds me of a Coding Horror (?) story where a client kept asking the developer to have their app window be on top (most visible.) Poor developer kept trying to explain that whatever method they used to be on top, anyone else could use to be also on top of their app. Anyways, there is no general heuristic to distinguish a good actor trying to prove their legitimacy from a bad actor trying to fake legitimacy. This is…

Post by 13of40 » Fri, Jul 02, 2021, 2:13 AM UTC

viraptor wrote: post #11

mjevans wrote: post #7

Earlier quoted context omitted.

Why doesn't Windows (Microsoft) build open source code themselves and sign the source seen, easier to inspect for bad things version?

It's not easy to spot malware, even if you have the source. For example Zoom can capture your screen, start applications, capture mic and camera, and allows remote control of your desktop. Why wouldn't it be blocked as malware even if you could automatically inspect the source?

Post by viraptor » Fri, Jul 02, 2021, 2:42 AM UTC

13of40 wrote: post #45

viraptor wrote: post #11

Earlier quoted context omitted.

It's not easy to spot malware, even if you have the source. For example Zoom can capture your screen, start applications, capture mic and camera, and allows remote control of your desktop. Why wouldn't it be blocked as malware even if you could automatically inspect the source?

Automated malware detection typically looks for behavior during installation rather than just the payload. (You can use the payload as a hint, though.) If an installer downloads a PNG and injects the last half of it into another process, and that drops an unsigned EXE into 'all users\startup' that can capture your screen, etc. you can probably block that without pissing too many people off. If you block SCREENCAP.EXE…

Post by AceJohnny2 » Fri, Jul 02, 2021, 3:35 AM UTC

bluedino wrote: post #43

AceJohnny2 wrote: post #19

Earlier quoted context omitted.

Reminds me of a Coding Horror (?) story where a client kept asking the developer to have their app window be on top (most visible.) Poor developer kept trying to explain that whatever method they used to be on top, anyone else could use to be also on top of their app. Anyways, there is no general heuristic to distinguish a good actor trying to prove their legitimacy from a bad actor trying to fake legitimacy. This is…

Close - Raymond Chen https://devblogs.microsoft.com/oldnewthing/20110310-00/?p=11...