Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not using Internet Explorer put me out of touch and cost me dearly

blurity.com

Post reply on HN
Print view View original

61–70 of 141 posts

Re: How not using Internet Explorer put me out of touch and cost me dearly

#61

Post by yelloblac »

tommi wrote: post #4
dmethvin wrote: post #3

If you are creating a Windows binary and expect a user to download it, you should be signing the binary. Period. It's not just IE that considers unsigned downloads suspect, many antivirus programs do as well. If you are proud of your work, sign it.

You forgot one step: "If you are proud of your work, then buy a certificate and sign your work"

I totally agree that maybe people shouldn't be HAVE to buy certificates for their binaries. In that case you should be making moves towards eliminating that process, ignoring the fact that it's necessary in the current market and then being upset when you're missing 50% of your profits is a whole other story entirely.

Re: How not using Internet Explorer put me out of touch and cost me dearly

#62

Post by teuobk »

Karunamon wrote: post #17
evolve2k wrote: post #7

Earlier quoted context omitted.

Anyone have opinions on good SSL certificate providers or do you agree with the authors recommendation of http://startssl.com ?

They do what they say they do at a decent price. However, their web interface sucks . Absolutely and completely sucks.

This is true. Their prices are good but their web interface is horrible. I felt like I was driving something built in 1999.

That said, their customer service has been very good and very prompt.

Re: How not using Internet Explorer put me out of touch and cost me dearly

#63

Post by chris_wot »

teuobk wrote: post #8
dmethvin wrote: post #3

If you are creating a Windows binary and expect a user to download it, you should be signing the binary. Period. It's not just IE that considers unsigned downloads suspect, many antivirus programs do as well. If you are proud of your work, sign it.

True. Part of the problem was simply not knowing that signing was a thing that needed to be done. It's obvious in hindsight, but since I hadn't released many Windows applications in the past, I didn't realize what I didn't know.

I've been a vocal supporter of the "don't worry about Internet Explorer" crowd. However, in this case if you have a Windows app that you want people to use, your target market is indeed Internet Explorer users.

Re: How not using Internet Explorer put me out of touch and cost me dearly

#64

Post by chris_wot »

MichaelApproved wrote: post #35
Karunamon wrote: post #17

Earlier quoted context omitted.

They do what they say they do at a decent price. However, their web interface sucks . Absolutely and completely sucks.

This is one of those times I miss the upvote counter on HN. I think it's important for the makers of StartSSL to see just how many people agree with you that their interface completely sucks. Without the counter, it just seems like one person's opinion while I bet many people agree.

HN is not there for the marketing purposes of companies.

Re: How not using Internet Explorer put me out of touch and cost me dearly

#65

Post by g-garron »

kuhn wrote: post #26

Thanks for sharing the numbers. Great to see the process by which you worked out how much it was costing you. Good wakeup call really. Shame it took you so long to cotton on.

I like how you found a good side to this story, instead of being criticizing what the writer should or should not know.

Re: How not using Internet Explorer put me out of touch and cost me dearly

#66

Post by dennisgorelik »

hobin wrote: post #40
SomeCallMeTim wrote: post #24

Earlier quoted context omitted.

>If MS was serious about this only being for security they could issue the certificates for free and prove me wrong. Make it too easy, and the scamware software will just get a free cert and sign apps. It takes some amount of effort, possibly by a human, to approve you to receive a cert. Even the "free" certs I've applied for have taken time and human interaction on the side of the registrar, and I'm certain those ce…

I'm unfamiliar with many of these certificates, but is there any reason such 'scamware' woudln't be able to get one even though it costs money? Because, if they still can, they the whole certification business definitely seems like a big scam to me.

When you pay money - you are leaving money trace which is likely to bite you if your product hurts people.

Re: How not using Internet Explorer put me out of touch and cost me dearly

#67

Post by DeepDuh »

X-Istence wrote: post #53
Turing_Machine wrote: post #44

Earlier quoted context omitted.

Apple gives out free developer id certificates. There's no reason Microsoft couldn't do the same.

Where does Apple give out free developer id certificates? Last I saw I had to purchase the $99 developer program ... https://developer.apple.com/resources/developer-id/

"Buy this cd boxset and you will get this wonderful christmas album FOR FREE!"

Re: How not using Internet Explorer put me out of touch and cost me dearly

#68

Post by [deleted] »

justindocanto wrote: post #37
gmurphy wrote: post #9

In general, not using the platform your users use is a path to trouble. For example, because so many designers in the valley use Macs, we continually have to fight an OS X bias in our design process; when designing something, you tend to calibrate it against what you're used to, but when OS X is only 5% of the market, OS X-based designers of client software end up with a massive blind spot when it comes to understand…

5% of 'the market' does not translate to 5% of users on your site. Depending on the site's demographic, as a developer, I see approx 15% Mac users making up traffic. Not to mention an ADDITIONAL 25% iPhone users. That's an average of 40% of apple traffic on the sites I work on. Some of which are getting 30k - 60k hits a month. Obviously this isnt the same stats across the board on all websites... but It is by no mean…

[deleted]

Re: How not using Internet Explorer put me out of touch and cost me dearly

#69

Post by Karunamon »

praxulus wrote: post #56
Karunamon wrote: post #19

Earlier quoted context omitted.

>it still smells of Raketeering to me. Congratulations - you have been enlightened to the state of PKI as it stands today. (I.e. a complete fucking scam).

I'm afraid I haven't been enlightened. How else can the PKI be structured while providing the same amount of security? Is public/private key cryptography itself fundamentally flawed? What's the alternative?

Most people care less about assurance and more about encryption. I.e., unless you're subject to a MITM DNS attack, you're a lot less likely to be directed at the wrong paypal.com than you are to say, have your password sniffed off the wire, or by a keylogger on the local machine.

And that identity assurance is where most of the scam comes in. Encrypting communication securely is dead simple (from an implementation standpoint - pick a cipher and go), making sure server X actually represents who they say they do, that's a whole different can of worms.

Re: How not using Internet Explorer put me out of touch and cost me dearly

#70

Post by harshreality »

praxulus wrote: post #56
Karunamon wrote: post #19

Earlier quoted context omitted.

>it still smells of Raketeering to me. Congratulations - you have been enlightened to the state of PKI as it stands today. (I.e. a complete fucking scam).

I'm afraid I haven't been enlightened. How else can the PKI be structured while providing the same amount of security? Is public/private key cryptography itself fundamentally flawed? What's the alternative?

Some combination of distributed notaries, warning for unusual certificate conditions (e.g. certs changing when they have lots of time until expiration -- Dear Google, please stop doing that), and other ideas.

Convergence http://convergence.io/ (notary)

Perspectives http://perspectives-project.org/ (notary)

CertPatrol http://patrol.psyced.org/ (cert checking)

TACK http://tack.io/ (only one cert per organizational group would need signing or notarizing)

Post reply on HN