Why does my installer get flagged by Windows? • Hacker News Board

Re: Why does my installer get flagged by Windows?

#51

Post by donmcronald » Fri, Jul 02, 2021, 3:59 AM UTC

judge2020 wrote: post #30

maille wrote: post #8

Earlier quoted context omitted.

You can automate code signing using Microsoft azure key vault. I did it last month, no need for a dongle nor a pin number

Also, Microsoft is working on a code signing service called Azure Code Signing where Microsoft issues and manages the certificate and keys and you simply upload binaries/app packages to Azure which does the signing. As far as I can tell, the video is the only public information on the non-GA service: https://youtu.be/Wi-4WdpKm5E?t=529

That sounds like abuse of a monopoly position to me. They keep the horrendous status quo as bad as possible so their new product looks good by comparison.

I’m ready for bipartisan gutting of big tech.

Re: Why does my installer get flagged by Windows?

#52

Post by donmcronald » Fri, Jul 02, 2021, 4:01 AM UTC

R0b0t1 wrote: post #33

jhurliman wrote: post #5

Earlier quoted context omitted.

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.

You can wire up a microcontroller to push the button as part of your CI/CD.

This is a hilarious solution that I would love to see gain popularity. Lol.

Re: Why does my installer get flagged by Windows?

#53

Post by nixpulvis » Fri, Jul 02, 2021, 5:18 AM UTC

scosman wrote: post #21

Also: Buy a the longest code signing cert you can. Reputation is acquired at cert and build level; updates signed with same cert are cleared much much faster. Cert reputation is lost when it expires, meaning back to square one to sign updates.

So reputation is the word we're using to mark sanctioned applications these days. Funny, I always think of reputation as a scale, not a boolean.

Also, this remains a constructed industry with only marginal benefits and major issues. Anyway...

Re: Why does my installer get flagged by Windows?

#54

Post by hoseja » Fri, Jul 02, 2021, 5:33 AM UTC

kryogen1c wrote: post #48

bluedino wrote: post #43

Earlier quoted context omitted.

Close - Raymond Chen https://devblogs.microsoft.com/oldnewthing/20110310-00/?p=11...

this post is a treasure, thanks for sharing. walls and ladders - ill remember that.

He also calls Windows security an "airtight hatch" and I laugh at the hubris.

Re: Why does my installer get flagged by Windows?

#55

Post by Stratoscope » Fri, Jul 02, 2021, 5:38 AM UTC

jhurliman wrote: post #5

viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.

Back in 2014 I was working at AltspaceVR (a social virtual reality startup) and we had Mac and Windows versions of the product. I set up a Mac Mini at the office to do the Mac builds, and it also ran a Windows VM under Parallels to do the Windows code signing. (The actual Windows builds ran in the cloud and we sent them down to the Windows VM for signing and then it sent them back up to the cloud.)

We had a Digicert code signing certificate that used a hardware key connected to the Windows VM. Unfortunately it required a password to be manually entered each time the code was signed.

To automate this, I wrote a little AutoHotkey script that watched for the password dialog and entered the password.

There wasn't any RDP issue because we didn't use RDP, just a Windows VM that didn't need any user intervention. (It could have been a separate physical machine, but since we had the Mini anyway and it had the capacity, it was convenient to have it do both the Mac builds and the Windows code signing.)

I sometimes think there are few problems that AutoHotkey cannot solve.

Re: Why does my installer get flagged by Windows?

#56

Post by R0b0t1 » Fri, Jul 02, 2021, 5:45 AM UTC

donmcronald wrote: post #52

R0b0t1 wrote: post #33

Earlier quoted context omitted.

You can wire up a microcontroller to push the button as part of your CI/CD.

This is a hilarious solution that I would love to see gain popularity. Lol.

People are actually using it. I have some vague interest in Windows driver development and this hardware token requirement hit there first.

Re: Why does my installer get flagged by Windows?

#57

Post by Stratoscope » Fri, Jul 02, 2021, 5:58 AM UTC

hoseja wrote: post #54

kryogen1c wrote: post #48

Earlier quoted context omitted.

this post is a treasure, thanks for sharing. walls and ladders - ill remember that.

He also calls Windows security an "airtight hatch" and I laugh at the hubris.

Not really. Here is what he actually wrote:

https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

He doesn't quite come out and say what "being on the other side of this airtight hatchway" means - it appears only in the title. But the post makes it clear what it alludes to: if you're already in a position to execute arbitrary code on the target machine in the security context you want, then you don't need to jump through further hoops, because you're already there.

Re: Why does my installer get flagged by Windows?

#58

Post by [deleted] » Fri, Jul 02, 2021, 6:02 AM UTC

viraptor wrote: post #47

13of40 wrote: post #45

Earlier quoted context omitted.

Automated malware detection typically looks for behavior during installation rather than just the payload. (You can use the payload as a hint, though.) If an installer downloads a PNG and injects the last half of it into another process, and that drops an unsigned EXE into 'all users\startup' that can capture your screen, etc. you can probably block that without pissing too many people off. If you block SCREENCAP.EXE…

That's old news. The race happens every day. AV companies upload samples to explode in a simulated environment, meanwhile malware authors started fighting back using `sleep(10000)` to avoid detection since that's longer than automation is worth running. The bad parts are not being executed until much later. Then the test environments started faking time speed ups. I think there was a good episode about that in the Ri…

[deleted]

Re: Why does my installer get flagged by Windows?

#59

Post by rblatz » Fri, Jul 02, 2021, 6:57 AM UTC

hoseja wrote: post #54

kryogen1c wrote: post #48

Earlier quoted context omitted.

this post is a treasure, thanks for sharing. walls and ladders - ill remember that.

He also calls Windows security an "airtight hatch" and I laugh at the hubris.

It's a Hitchhikers Guide to the Galaxy reference.

Re: Why does my installer get flagged by Windows?

#60

Post by PhasmaFelis » Fri, Jul 02, 2021, 7:02 AM UTC

Somewhat related: I would really like some sort of OS-wide flag informing all apps and websites that, yes, I understand what a hyperlink is, it is not necessary to warn me when I click one that it will take me to a website.