Off-topic: I was giving a presentation and needed to download something from microsoft.com, it was a wsl update or something. After download MS-Edge marked it as dangerous and harmful. Needless to say the audience bursted in laughter and I was able to convert some people to Firefox that day.
Why does my installer get flagged by Windows?
61–70 of 85 posts
Re: Why does my installer get flagged by Windows?
#62Re: Why does my installer get flagged by Windows?
#63It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…
Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.
Of course, there's a kinda reasonable reason for the hardware token requirement: Widely publicised 2010 virus 'StuxNet' had a driver signature, using a stolen copy of Realtek's driver signing certificate. [1]
And stolen certificates make the whole code-signing house of cards falls apart - you can't trust something signed by Realtek if it was not, in fact, signed by Realtek!
Of course, hardware tokens aren't a panacea: Some malware authors simply set up a shell company and get a certificate issued to that company.
[1] https://www.trendmicro.com/en_us/research/18/d/understanding...
Re: Why does my installer get flagged by Windows?
#64The installer gets flagged because the game isn't Security, it's really Compliance.
I'm thinking of FTC and oligopoly.
Re: Why does my installer get flagged by Windows?
#65Earlier quoted context omitted.
Sounds like the hardware key requires a pin, but not physical presence (i.e. not a button touch), so it can be automated https://stackoverflow.com/questions/17927895/automate-extend...
One of my clients has strict requirements for an automated build process, and we managed to use an EV code signing cert on a YubiKey w/ PIN - so it’s definitely possible with a little leg work. After having gone through it, I agree with other posts that the main annoyance is the verification process and weeks of delays/back-and-forth. That, and the inconvenience of now having a single point of failure in the build pr…
> inconvenience of now having a single point of failure in the build process (unless multiple certs are purchased).
Except that's not quite true is it.
Most (all ?) devices (even the cheap USB ones) have secure wrapped backup/restore mechanisms.
All you had to do was set up your device correctly in the first place (since the wrapping can't be activated retrospectively).
Some of the cert vendors even have ready-made instructions available to follow on their website telling you exactly how to do this: https://www.ssltrust.co.uk/help/setup-guides/mofn-setup-nitr...
RTFM as they say. ;-)
Re: Why does my installer get flagged by Windows?
#66Earlier quoted context omitted.
Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.
Back in 2014 I was working at AltspaceVR (a social virtual reality startup) and we had Mac and Windows versions of the product. I set up a Mac Mini at the office to do the Mac builds, and it also ran a Windows VM under Parallels to do the Windows code signing. (The actual Windows builds ran in the cloud and we sent them down to the Windows VM for signing and then it sent them back up to the cloud.) We had a Digicert…
Agreed, AutoHotkey is awesome!
Re: Why does my installer get flagged by Windows?
#67It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…
Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.
You need the key, but there are ways to get a .pfx out of it. Which I unfortunately don't remember, but that is probably documented by whoever you got the key from. And otherwise signtool can be used with the key, though it is not always trivial to get working.
Re: Why does my installer get flagged by Windows?
#68It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…
We had to manage flagging problems at my company and even though we now sign our installers with a EV Certificate, anti-virus software have their own reputation database and still flag our work until a certain amount of users install it
Re: Why does my installer get flagged by Windows?
#69It's an extortion racket. They want you to go through Windows Store.
Re: Why does my installer get flagged by Windows?
#70Be warned: EV-code signing certificates do not work as advertised. There is no instant reputation. My company tried this and it does not work.
I'm not sure what to do anymore. We are a small company with few customers. Slowly gaining reputation over time does not seem like a viable path.