Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does my installer get flagged by Windows?

blog.pakkly.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: Why does my installer get flagged by Windows?

#71

Post by richrichardsson »

scosman wrote: post #21

Also: Buy a the longest code signing cert you can. Reputation is acquired at cert and build level; updates signed with same cert are cleared much much faster. Cert reputation is lost when it expires, meaning back to square one to sign updates.

Even just to avoid the pain of acquiring the certificate on a yearly basis.

I've never had a smooth ride getting a Code Signing Cert, always some stupid bureaucratic rubbish to deal with, or the need to run some stupid obsolete browser in order to actually get the thing, and I know at least 2 others who also ran into the same crap.

Re: Why does my installer get flagged by Windows?

#73

Post by sixothree »

innocenat wrote: post #41
sixothree wrote: post #16

Earlier quoted context omitted.

Regular code signing cert is often good enough.

The entire point of the article is that it is not good enough though.

And here I am telling you I've done this and it has worked and continues to work today.

Do whatever you want with that information.

Re: Why does my installer get flagged by Windows?

#74

Post by inspector-g »

traceroute66 wrote: post #65
inspector-g wrote: post #15

Earlier quoted context omitted.

One of my clients has strict requirements for an automated build process, and we managed to use an EV code signing cert on a YubiKey w/ PIN - so it’s definitely possible with a little leg work. After having gone through it, I agree with other posts that the main annoyance is the verification process and weeks of delays/back-and-forth. That, and the inconvenience of now having a single point of failure in the build pr…

> inconvenience of now having a single point of failure in the build process (unless multiple certs are purchased). Except that's not quite true is it. Most (all ?) devices (even the cheap USB ones) have secure wrapped backup/restore mechanisms. All you had to do was set up your device correctly in the first place (since the wrapping can't be activated retrospectively). Some of the cert vendors even have ready-made i…

Correct me if I'm wrong, but when a fully preconfigured YubiKey is shipped to you as part of the EV cert fulfillment, then there is no way to do this after-the-fact.

Re: Why does my installer get flagged by Windows?

#75

Post by vb6sp6 »

jhurliman wrote: post #5
viraptor wrote: post #2

It's really annoying we don't have a better solution for this. Even outside of open source, I don't want to spend over $600 up front before I sell a single copy of an app just to stop MS from blocking it. And that's not even mentioning companies like sectigo being terrible at their job. I've spent over a week going in circles with their support about verification: "your license shows address A", "no, the back shows t…

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.

yeah, i thought this too but it was really easy to automate

Re: Why does my installer get flagged by Windows?

#76

Post by vb6sp6 »

cjensen wrote: post #26
evanelias wrote: post #22

Earlier quoted context omitted.

Worse still, the SafeNet software that my cert vendor recommends using (to interact with the hardware key) doesn't even allow use of Remote Desktop sessions! It somehow detects if you're in an RDP session, and shows that there are no hardware tokens attached if that's the case. No message or warning whatsoever. My only Windows PC is headless and I lost several hours trying to debug this. The entire EV cert process is…

One way around SafeNet is to run the builder in a VM, then RDP into the host.

or use vnc, teamviewer, etc

Re: Why does my installer get flagged by Windows?

#77

Post by vb6sp6 »

sixothree wrote: post #73
innocenat wrote: post #41

Earlier quoted context omitted.

The entire point of the article is that it is not good enough though.

And here I am telling you I've done this and it has worked and continues to work today. Do whatever you want with that information.

And here I am telling you I've done this and it didn't work. The EV cert worked a lot better.

Do whatever you want with that information.

Re: Why does my installer get flagged by Windows?

#78

Post by vb6sp6 »

wronex wrote: post #70

Be warned: EV-code signing certificates do not work as advertised. There is no instant reputation. My company tried this and it does not work. I'm not sure what to do anymore. We are a small company with few customers. Slowly gaining reputation over time does not seem like a viable path.

Also a small company. The ev cert worked for us. Are you having trouble with smartscreen or av products?

Re: Why does my installer get flagged by Windows?

#79

Post by sixothree »

vb6sp6 wrote: post #77
sixothree wrote: post #73

Earlier quoted context omitted.

And here I am telling you I've done this and it has worked and continues to work today. Do whatever you want with that information.

And here I am telling you I've done this and it didn't work. The EV cert worked a lot better. Do whatever you want with that information.

That's too bad. I see why you're angry. Good luck!

FTA btw "Essentially you have the option of two different kinds of certificates and three different price levels, depending on your urgency and user sensitivity."

Maybe you need to change something about your application.

Re: Why does my installer get flagged by Windows?

#80

Post by sixothree »

innocenat wrote: post #41
sixothree wrote: post #16

Earlier quoted context omitted.

Regular code signing cert is often good enough.

The entire point of the article is that it is not good enough though.

And to be fair that is very much _not_ the entire point of the article.

"Essentially you have the option of two different kinds of certificates and three different price levels, depending on your urgency and user sensitivity."

Post reply on HN