Microsoft Defender SmartScreen is hurting independent developers

Post by donmcronald » Wed, Jun 03, 2020, 11:18 AM UTC

thefounder wrote: post #221

duskwuff wrote: post #161

Earlier quoted context omitted.

OTOH: On macOS, you pay $100/yr and you're set -- any apps you notarize will launch with a simple confirmation dialog. On Windows, you can spend hundreds of dollars on a security certificate and still get blocked by SmartScreen and/or antivirus software. I'm not aware of any situations where Apple has declined to offer a developer certificate to a developer, outside of situations where they are legally barred from do…

>> On Windows, you can spend hundreds of dollars on a security certificate and still get blocked by SmartScreen and/or antivirus software. You are wrong. As described in the OP if you buy EV certificate($70) [0] you are all set. >> I'm not aware of any situations where Apple has declined to offer a developer certificate I can see that. Still there are such cases. Monopoly on the approval process is bad anyway. Even i…

Post by ebg13 » Wed, Jun 03, 2020, 3:41 PM UTC

criddell wrote: post #232

ebg13 wrote: post #95

Earlier quoted context omitted.

You don't get to handwave away a clear fallacy with "ok but you get the point". _My_ point is that the point is false, not that the example is bad. If Bonzi Buddy can just buy their way into your computer, then this does not save you. From anything. Because real malicious actors like Bonzi Buddy can just buy their way in!

A trojan that steals banking information is going to be able to afford a certificate, but they aren't going to buy one because they would have to identify themselves.

Post by criddell » Wed, Jun 03, 2020, 4:23 PM UTC

ebg13 wrote: post #233

criddell wrote: post #232

Earlier quoted context omitted.

A trojan that steals banking information is going to be able to afford a certificate, but they aren't going to buy one because they would have to identify themselves.

> they would have to identify themselves False. https://en.wikipedia.org/wiki/Identity_fraud In order to understand this, you really need to start thinking like a criminal. "If I had money, power, maybe guns, and no conscience or care for anyone else, what could I get away with?"

Post by thefounder » Wed, Jun 03, 2020, 9:55 PM UTC

duskwuff wrote: post #234

thefounder wrote: post #221

Earlier quoted context omitted.

>> On Windows, you can spend hundreds of dollars on a security certificate and still get blocked by SmartScreen and/or antivirus software. You are wrong. As described in the OP if you buy EV certificate($70) [0] you are all set. >> I'm not aware of any situations where Apple has declined to offer a developer certificate I can see that. Still there are such cases. Monopoly on the approval process is bad anyway. Even i…

> You are wrong. As described in the OP if you buy EV certificate($70) [0] you are all set. That's an EV SSL certificate, not an EV code signing certificate, which costs significantly more and still doesn't prevent an application from being blocked by antivirus software.

Post by [deleted] » Wed, Jun 03, 2020, 10:01 PM UTC

donmcronald wrote: post #231

thefounder wrote: post #221

Earlier quoted context omitted.

>> On Windows, you can spend hundreds of dollars on a security certificate and still get blocked by SmartScreen and/or antivirus software. You are wrong. As described in the OP if you buy EV certificate($70) [0] you are all set. >> I'm not aware of any situations where Apple has declined to offer a developer certificate I can see that. Still there are such cases. Monopoly on the approval process is bad anyway. Even i…

That’s an SSL certificate. Anyone who pays for that is dumb. Anyone that tries to use it for code signing is dumber.