21–30 of 141 posts
Earlier quoted context omitted.
You forgot one step: "If you are proud of your work, then buy a certificate and sign your work"
Anyone have opinions on good SSL certificate providers or do you agree with the authors recommendation of http://startssl.com ?
Earlier quoted context omitted.
You forgot one step: "If you are proud of your work, then buy a certificate and sign your work"
Anyone have opinions on good SSL certificate providers or do you agree with the authors recommendation of http://startssl.com ?
If you're on Windows, one thing to keep in mind is to use IE or Firefox when buying the cert. After the purchase is approved, you need to navigate to the site in the same browser that you purchased it, and only IE and FF are supported.
While that is nice to know, it still smells of Raketeering to me. "that is some nice software you have there, would be a shame if users thought it was dangerous" "pay a little money to one of these approved companies and that warning will go away" If MS was serious about this only being for security they could issue the certificates for free and prove me wrong. On the other hand, why is it that about 20% of users cli…
Make it too easy, and the scamware software will just get a free cert and sign apps.
It takes some amount of effort, possibly by a human, to approve you to receive a cert.
Even the "free" certs I've applied for have taken time and human interaction on the side of the registrar, and I'm certain those certs are offered as loss-leaders for their other products.
I know some people have voiced concerns about Gatekeeper in 10.8, but this seems at least as bad. Especially from a normal user's perspective.
Gatekeeper is not nearly as bad for small developers, though. Unless Microsoft has started offering, as part of a $99 MSDN subscription, the ability to generate a signed certificate that doesn't expire for five years automatically from inside Visual Studio as soon as you've signed in with your Microsoft ID. The problem with Microsoft's strategy has always been the reliance on companies like VeriSign for whom recurrin…
I'm no expert on these sorts of things, but it seems like the story goes something like this: 1. Dev checks out his site using IE 2. Dev realizes that IE users were getting scary warnings about his software 3. Dev has to pay up money to a third company to make the scary warnings go away. Seems like a bad state of affairs to me.
I mean, it's true, there is a difference here- the active "This software isn't certified" notification- but is that a critical distinction?
If you are creating a Windows binary and expect a user to download it, you should be signing the binary. Period. It's not just IE that considers unsigned downloads suspect, many antivirus programs do as well. If you are proud of your work, sign it.
Maybe I'm too proud of my work to give in to certificate blackmail??
I'm no expert on these sorts of things, but it seems like the story goes something like this: 1. Dev checks out his site using IE 2. Dev realizes that IE users were getting scary warnings about his software 3. Dev has to pay up money to a third company to make the scary warnings go away. Seems like a bad state of affairs to me.
I'd love to hear how this isn't grounds for a product disparagement lawsuit. Are any attorneys familiar with SmartScreen Filter? A couple of relevant points that may be overlooked: 1) Signing your code, even with an expensive class-3 Authenticode certificate from Verisign that allows you to sign kernel drivers, is no guarantee that IE will not accuse you of distributing potential malware. 2) Contrary to various posti…
Earlier quoted context omitted.
Maybe I'm too proud of my work to give in to certificate blackmail??
That's nice, but you can't eat dignity. :P
My family taught me to always do the right thing, which, most of the time, is neither the most convenient nor the most profitable.
It should be trivial to provide a free binary signing service that required some steps to prove the person (or website) is the person asking the binary to be signed (much like Google asks me to upload a file or setup a DNS record) and match the file signature to the URL of the download. Let's not forget every one who would rely on it already paid for a license of Windows.
Of course, this would probably kill download sites, but the internet would be better off without them anyway.