Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Defender SmartScreen is hurting independent developers

getimageview.net

Post reply on HN
Print view View original

161–170 of 243 posts

Re: Microsoft Defender SmartScreen is hurting independent developers

#161

Post by duskwuff »

thefounder wrote: post #127

Look at this from anither angle: on MacOS it is worse. You can "buy" certificates/approval only from Apple. If Apple doesn't like you, you are screwed!

OTOH: On macOS, you pay $100/yr and you're set -- any apps you notarize will launch with a simple confirmation dialog. On Windows, you can spend hundreds of dollars on a security certificate and still get blocked by SmartScreen and/or antivirus software.

I'm not aware of any situations where Apple has declined to offer a developer certificate to a developer, outside of situations where they are legally barred from doing so (e.g, for developers in countries subject to US economic sanctions, who would probably be unable to obtain a software signing certificate either).

Re: Microsoft Defender SmartScreen is hurting independent developers

#162

Post by driverdan »

notyourday wrote: post #131
driverdan wrote: post #112

Earlier quoted context omitted.

As someone who used to make fake IDs it would be very easy to pass EV checks. It's like putting a padlock on a gate. Anyone who wants to get past it can easily do so.

I have a hard time believing this. Based on my experience, a part of the EV check was checking of the business entity with the state and sending snail mail to the address of record. Since our registered address was a law firm, I had to go through all kinds of hoops to get that letter as it contained the string needed to proceed to the next step in the EV verification.

That's easy with a fake ID. You can get a personal mailbox (eg UPS Store) with fake IDs and register a company on the state's website with an anonymous prepaid debit card.

This is less than a day's worth of work to setup.

Re: Microsoft Defender SmartScreen is hurting independent developers

#163

Post by driverdan »

notyourday wrote: post #146
Nextgrid wrote: post #135

Earlier quoted context omitted.

You can recruit a clueless person to be a “virtual assistant” or similar, give them some random admin tasks (to make it feel legitimate) before sending the letter to their address and asking them to read/scan the contents for you. A similar approach is successfully used by scammers to recruit money mules.

You have to be first registered with the state and the feds (IRS) as a business which creates all kinds of legal obligations and paperwork.

In most US states it's very easy and inexpensive to register a business.

Re: Microsoft Defender SmartScreen is hurting independent developers

#164

Post by close04 »

ebg13 wrote: post #83
fh973 wrote: post #77

Earlier quoted context omitted.

Not that simple to just pay. You need an EV certificate ( https://en.m.wikipedia.org/wiki/Extended_Validation_Certific... ), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.

> malware outfits bringing in millions of dollars a year

With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place without completely sacrificing usability.

You should see most security measures as the lock on your door. It doesn't take an expert to crack but still stops most from even attempting it. No security measure is 100% effective but it still raises the bar for a successful attack.

You seem to have a bone to pick with MS's choice so I'm genuinely curious in which direction would you go. And keep in mind you have a billion users and a truck load of baggage to work with.

Re: Microsoft Defender SmartScreen is hurting independent developers

#165

Post by contextfree »

WorldMaker wrote: post #151
ripley12 wrote: post #143

Earlier quoted context omitted.

> MSIX can be sideloaded by default in every supported version of Windows Is that true? I thought MSIX sideloading was only enabled by default in the recent Win10 2004 release (better late than never!). https://www.windowslatest.com/2019/08/12/windows-10-20h1-imp...

APPX sideloading has been enabled by default since at least the Anniversary Update. Not every MSIX will sideload if just renamed to APPX, but many will (including many Win32 applications). Microsoft has stated that every actively supported Windows 10 feature update from the Anniversary Update forward will receive updates to enable the rest of MSIX and the MSIX file extension, including sideloading.

You're both partly right - it was enabled by default in Home and Pro editions since 2016, but is just now being enabled by default in the Enterprise edition in the new version 2004 update.

Re: Microsoft Defender SmartScreen is hurting independent developers

#166

Post by [deleted] »

mceachen wrote: post #159
xoail wrote: post #24

I recently went through this pain for an electron app. Non-EV code sign cert kept throwing SmartScreen warnings for most users. Acquiring an EV cert forced me to register a company and a hefty cert price per year, overall costing nearly $1500. Not to mention overall delay and added costs. Meanwhile my $100/y Apple Dev subscription was enough to package the app and distribute outside App Store. At this point I am fair…

Oof. Next time you need to renew, check the links from the msft authenticode dev website for ev certs. A couple providers are much less than $1500/yr. Also, when I got my renewal bill for something like $1500/yr for PhotoStructure, I sent an email to their support asking to continue the low original fee, and they agreed.

[deleted]

Re: Microsoft Defender SmartScreen is hurting independent developers

#168

Post by contextfree »

WorldMaker wrote: post #74
samcat116 wrote: post #9

Interesting that they aren't doing it the same way as Apple, where you pay to be part of the program and they provide all the certificates. Certainly seems cheaper at $100/yr compared to the prices of these certs. Also why are these certs so much more expensive compared to a normal SSL certificate?

Microsoft provides an option to do exactly that. Microsoft Store will handle all the certificates for you for $100/year and their Store cut is smaller than Apple's if you decide to sell through the Store.

if I'm not mistaken it's a one-time (not annual) fee of $19 for an individual account or $99 for a company account (required for Win32 apps)

https://docs.microsoft.com/en-us/windows/uwp/publish/account...

Re: Microsoft Defender SmartScreen is hurting independent developers

#169

Post by fierarul »

magicalhippo wrote: post #156
fierarul wrote: post #73

Dear GitHub CEO reading this message on HN: a cool feature would be a GitHub action to sign binaries for free . It's ridiculous that my open source code is hosted on GitHub, the binary is created with an action but I have to pay for a certificate and manually sign it.

I guess since Microsoft through GitHub controls the build process, couldn't they also include the signed source as well as a combined signature? Idea being that one could, in theory, download the git repo, check out the relevant commit and verify that this was the source code and this was the resulting binary, and that matches the exe file I just downloaded.

Yes! I bet there are numerous ways this could be implemented to make things easier for developers and end users.

With the current setup GitHub has more control on the resulting bits than I do.

Also, current Microsoft signature rules that a hardware dongle is required to sign the bits (all non-hardware certificates will be deprecated in time).

So, I'm supposed to take the .EXE that GitHub produced on one of their VMs running actions then certify it's legit by signing it with my certificate.

But what am I actually certifying? Well, that to the best of my knowledge this EXE is the build output of this Git commit that triggered the action.

Post reply on HN