5 ms·

EV Code signing certs get you immediate trust with Smart Screen. Recently discussed over on the bootstrapped forum: http://discuss.bootstrapped.fm/t/code-signin

by wyday 8y ago

EV Code signing certs get you immediate trust with Smart Screen. Recently discussed over on the bootstrapped forum: http://discuss.bootstrapped.fm/t/code-signing-certificate-recommendation/5806/8?u=wyattoday http://discuss.bootstrapped.fm/t/code-signing-certificate-re... Regular, non-EV code-signing certs, aren't as useful as they were when Vista / Windows 7 were the main Windows OSes.

fuzzy2 8y ago
Interesting, I wasn’t aware of that. However, isn’t getting an EV certificate impossible for a natural person? You’d have to be some sort of legally recognized organization. Not exactly suitable for small-scale Open Source development.
- gruez 8y ago
  >However, isn’t getting an EV certificate impossible for a natural person? You’d have to be some sort of legally recognized organization no? random example: https://sourceforge.net/projects/keepass/files/KeePass%202.x/2.38/KeePass-2.38-Setup.exe/download https://sourceforge.net/projects/keepass/files/KeePass%202.x... signer is: "Open Source Developer, Dominik Reichl" edit: another example https://yarnpkg.com/latest.msi https://yarnpkg.com/latest.msi signer is: "Daniel Lo Nigro"
  - fuzzy2 8y ago
    KeePass: This isn’t an EV certificate (has only OID 2.23.140.1.4). Certum also clearly states, topmost on the description of how to get an EV Code Signing certificate: > We do not issue EV Code Signing certificates to natural persons! Yarn: Not an EV certificate either: "Organizationally validated certificates used to sign standard objects." (2.16.840.1.114412.3.1 in addition to 2.23.140.1.4.1).
Boulth 8y ago
I wonder what do you mean by "not useful"? They just have to participate in the reputation system, but that's an issue only when the certificate is young. Here's an excerpt from MSDN: > Detractors may claim that SmartScreen is “forcing” developers to spend money on certificates. It should be stressed that EV code signing certificates are not required to build or maintain reputation with SmartScreen. Files signed with standard code signing certificates and even unsigned files continue to build reputation as they have since Application Reputation was introduced in IE9 last year. However, the presence of an EV code signing certificate is a strong indicator that the file was signed by an entity that has passed a rigorous validation process and was signed with hardware which allows our systems to establish reputation for that entity more quickly than unsigned or non-EV code signed programs. Source: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...
- wyday 8y ago
  I didn’t say “not useful”. Clearly they’re useful. I said non-EV certs “aren’t as useful”. Which is just a fact (as evidenced by the Smart Screen “reputation boost” that EV certs get). I already read that blog post. I’m person that linked to it in the forum post.

by wyday 8y ago

fuzzy2 8y ago

Interesting, I wasn’t aware of that. However, isn’t getting an EV certificate impossible for a natural person? You’d have to be some sort of legally recognized organization. Not exactly suitable for small-scale Open Source development.

gruez 8y ago
>However, isn’t getting an EV certificate impossible for a natural person? You’d have to be some sort of legally recognized organization no? random example: https://sourceforge.net/projects/keepass/files/KeePass%202.x/2.38/KeePass-2.38-Setup.exe/download https://sourceforge.net/projects/keepass/files/KeePass%202.x... signer is: "Open Source Developer, Dominik Reichl" edit: another example https://yarnpkg.com/latest.msi https://yarnpkg.com/latest.msi signer is: "Daniel Lo Nigro"
- fuzzy2 8y ago
  KeePass: This isn’t an EV certificate (has only OID 2.23.140.1.4). Certum also clearly states, topmost on the description of how to get an EV Code Signing certificate: > We do not issue EV Code Signing certificates to natural persons! Yarn: Not an EV certificate either: "Organizationally validated certificates used to sign standard objects." (2.16.840.1.114412.3.1 in addition to 2.23.140.1.4.1).

Boulth 8y ago

I wonder what do you mean by "not useful"? They just have to participate in the reputation system, but that's an issue only when the certificate is young. Here's an excerpt from MSDN: > Detractors may claim that SmartScreen is “forcing” developers to spend money on certificates. It should be stressed that EV code signing certificates are not required to build or maintain reputation with SmartScreen. Files signed with standard code signing certificates and even unsigned files continue to build reputation as they have since Application Reputation was introduced in IE9 last year. However, the presence of an EV code signing certificate is a strong indicator that the file was signed by an entity that has passed a rigorous validation process and was signed with hardware which allows our systems to establish reputation for that entity more quickly than unsigned or non-EV code signed programs. Source: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...

wyday 8y ago
I didn’t say “not useful”. Clearly they’re useful. I said non-EV certs “aren’t as useful”. Which is just a fact (as evidenced by the Smart Screen “reputation boost” that EV certs get). I already read that blog post. I’m person that linked to it in the forum post.