12 ms·
Windows gifski.exe with a digital signature
- codetrotter 8y agoThat's cool I guess. So what is gifski? Answered in the project README: "Highest-quality GIF encoder based on pngquant".
- gpvos 8y agoLooks quite impressive actually. I had no idea you could get this kind of quality out of a GIF.
- mrguyorama 8y agoAs someone who enjoys the idea of writing stupid programs for my own use, occasionally even doing dumb things to the kernel, the games I have to play to work with the Software I paid for is disheartening. Yes, yes, if I screw up a kernel mode driver while toying around with faking USB input, I could brick my computer forever, but since I've already found my way to the driver SDK, and decided to continue, isn't that proof enough of willingness to take the risk?
- freeone3000 8y agoUse a self-signed cert and add it to your own root trust store. That's the sign you trust yourself enough to take that risk :)
- bb88 8y agoThis is really terrible. No wonder no one wants to develop open source software on windows anymore.
- ShabbosGoy 8y agoWhy would they want to do that in the first place?
- CamperBob2 8y agoUh, for the same reasons they would do so on any other platform? That said, yes, this guy is doing it wrong. He should be using SHA-256, not SHA-1, and he should be using an EV cert (which takes more like 60 minutes to obtain than 6 months.)
- ShabbosGoy 8y ago> Uh, for the same reasons they would do so on any other platform? Wrong. Windows is a closed source, proprietary platform. One would develop OSS for an OSS operating system.
- SmellyGeekBoy 8y agoWhy would open source developers not want to target the desktop OS with the largest install base in the world? Not everyone in the OSS world is Richard Stallman, most just want to build and release software for people to actually use. (I say that as a full time Linux user, developer, and OSS advocate, btw).
- CamperBob2 8y agoOne nice thing about an open source application is that if you don't use (or simply don't like) the OS it runs on, you can port it to your OS of choice or hire someone to do it for you. Stallman himself would have no problem with that, if he's logically consistent.
- pornel 8y agoTo be honest, Microsoft's C compiler was the reason I didn't support Windows before (for MSVC the 1999 C standard is still too new). I've only started making Windows executables after switching to Rust.
- pjmlp 8y agoFor MSFT C use cases have been long replaced by C++ and the compiler is called Visual C++. They support C11 to the extent required by ANSI C++17. For anything else, the offcial answer is to use clang or gcc.
- grenoire 8y agoHah, plus points for Vogon poetry!
- titanix2 8y agoThis alert is so annoying and stupid it hurts. I had it too when running one of my own program. I guess this is part of MS strategy: FUDing traditional applications in a desperate attempt to get people to use their store. Except the store won't become attractive anytime soon by alienating developers.
- Someone1234 8y ago> I had it too when running one of my own program. Turn on Developer Mode in "For Developer" Settings.
- deleted 8y ago[deleted]
- DaiPlusPlus 8y agoThe warning goes away for "widely used" binaries. I maintain a desktop application (with MSI installer) for a niche industry with a few hundred users and for the first few weeks they had the scary red warning, but after then they started seeing the blue, non-scary pop-up, even for new binaries provided they're signed with the same certificate. We have a Comodo code-signing cert (non-EV though) which costs ~$70/yr through Tucows (remember them?).
- jenscow 8y agoSo what gets "trusted"? The certificate, or the publisher?
- eps 8y agoAn EV sig on .exe automatically whitelists any it with SmartScreen. It still shows a message, but a far less scary one. Edit - hmm, it sounds like the dev got an EV cert though, because regular ones don’t require storing keys on a token. So I’m not sure what’s going on here...
- mnkypete 8y agoI think a proper EV should not show any warning at all. The issue here is using SHA1 instead of SHA256, not sure why op would do this. SHA1 signing was deprecated.. https://www.globalsign.com/en/blog/microsoft-announces-updates-sha-1-code-signing-policy/ https://www.globalsign.com/en/blog/microsoft-announces-updat...
- abawany 8y agoOne reason is that if signing via the Mono Framework, the only signing method it offers is SHA-1. I had to eventually sign with `osslsigncode` to get this right. I was trying to cross-compile a Windows app on Linux, which is why the Mono solution appeared to make sense.
- setquk 8y agoOur EV cert shows an alert. Very fucking annoyed if I’m honest. And yes it was SHA-256. Several days and a pile of cash fucking around with WIX and signtool for what exactly?
- mnkypete 8y agoCheck this Stack overflow thread. For us it was cached SHA1 certificates in the cert chain: https://security.stackexchange.com/questions/109629/deprecation-of-sha1-code-signing-certificates-on-windows/113114#113114 https://security.stackexchange.com/questions/109629/deprecat... But yeah, it's a pain..
- setquk 8y agoThanks for the link. I don't think it was that but I'm going to check it thoroughly anyway.
- sp332 8y agoThe security theater is just to shift liability. They don't care if the documents are fake, they just want the fraud to be plausibly your fault instead of theirs.
- draw_down 8y agoYes, same with the scare-screens. If you click “run anyway”, any repercussions can’t be MS’s fault.
- ryandrake 8y agoIs this some new Windows thing? Because the last time I booted Windows and downloaded some pre-built open source Windows program and ran it I got no such warning.
- 21 8y agoIt's also based on whitelists and popularity counts. BTW, Chrome has a similar thing, compile an .exe, put it on a personal site, and try to download it.
- RachelF 8y agoAs some some anti-virus tools. Norton AV used to "clean up" my build folders of exes because it was classifying the newly built exe as viruses because they were not on a whitelist.
- jle17 8y agoI used to develop a java app during an internship on a computer I was not even supposed to be admin on. McAfee AV crapware was randomly deciding that my app .jar was in need of being removed and there was nothing I could do without going against company policy except rebuild and hope this time it would go well.
- mnkypete 8y agoThis alert would not show if you used SHA256 instead of SHA1, which was deprecated: https://www.globalsign.com/en/blog/microsoft-announces-updates-sha-1-code-signing-policy/ https://www.globalsign.com/en/blog/microsoft-announces-updat... EV certs immediately gain trust: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...
- gruez 8y ago>This alert would not show if you used SHA256 instead of SHA1, which was deprecated apparently sha2 signing wasn't working for him https://news.ycombinator.com/item?id=17200491 https://news.ycombinator.com/item?id=17200491 >I would have signed with SHA-2, which for inexplicable reason is not default despite deprecation, but my signtool crashed when I enabled it.
- ehsankia 8y agoAnother 6 months!
- slededit 8y agoThey aren't sufficient to get rid of the slanderous message on their own - even with an EV. You need to have a bit of volume first. Makes interacting with your first few customers lots of fun.
- mnkypete 8y agoThat's not true though. We have very little volume installs and since the EV, there has has not been one of these messages..
- slededit 8y agoI've had differing experiences. Note that if you've been distributing before you got the cert part of that rep will carry over as its also a function of the exe signature.
- r1ch 8y agoNot really sure what this is trying to point out. It's hardly the fault of Windows or the CA if he signs his code with SHA1.
- pornel 8y agoThat's me! I was incredibly salty about this. I didn't name the CA, because they're actually nice to have reduced price for Open Source projects, but Microsoft really needs to drag the whole process into the 21st century. The process and infrastructure reminds me very much of TLS before Let's Encrypt. If this is something that every developer needs to do for every exe, it can't be like getting an EV certificate for a Netscape Server. I thought Apple's often-buggy signing was bad, but at least they've tried to make it a one checkbox paid for in a straightforward transaction. I would have signed with SHA-2, which for inexplicable reason is not the default despite deprecation, but my signtool crashed when I enabled it.
- mnkypete 8y agoInteresting, what command did you use? This works for us without any issues: signtool sign /a /fd SHA256 /tr "http://timestamp.globalsign.com/?signature=sha2" http://timestamp.globalsign.com/?signature=sha2" /td SHA256 <exefile>
- pornel 8y agoI've copied that exact command from 3rd party documentation. Microsoft didn't even bother to give a SHA-2 example in theirs. And maybe I'm spoiled, but could it not require four switches of a "don't do useless thing" kind? It's as if `copy` required /ones /zeros switches to be explicit you don't want it to omit these bits.
- ben509 8y agoIt's a safety issue though. Only experts should run `copy /ones /zeros`, because if you get too many ones on one side and zeros on the other it can throw off your hard disk's alignment and void your warranty.
- IvyMike 8y agoWhich signtool did you use? (You may have more than one on your system. This has cost me more time than I would like to admit. I'd make sure you're using the one from the latest Win 10 SDK.)
- badsectoracula 8y agoHow much i hate this error message. "Windows protected your PC" - no, it didn't, it just assumed there would be something to protect from because it was unknown. It is pure scaremongering.
- ocdtrekkie 8y agoThe average Windows user will never/should never run a program SmartScreen doesn't know about. Everyone else knows how to vet the app they're using themselves. For your senior citizen browsing the web and clicking things, this dialog saves people. More often than you'd think.
- seba_dos1 8y agoThe average Windows user just learned how to ignore this dialog and click through it. Especially gamers, downloading unsigned indies from stores like itch.io.
- TheCoreh 8y agoThe average Windows user is not a gamer though, and if they are, they probably buy games from Steam, not itch.io
- ocdtrekkie 8y agoNo, I get calls from people about Windows update wanting to restart and asking me if it's okay to let it. You don't know what an average user looks like.
- seba_dos1 8y agoThat's below average user, they generate most of the calls like that. Looking around schools is a pretty good way to see what average user might look like.
- ocdtrekkie 8y ago
- jenscow 8y agoCA was Certum, according to the certificate
- z3t4 8y agoPaying thousands of dollars per year just so that users can run your free software is ludicrous. Code signing does nothing but teaching users to ignore security errors. Nothing is stopping bad actors from signing executables. Platforms are too lazy by putting the burden on the developer. Why not let users download the apps directly from the publisher/developer ? I guess that would make it harder for the platform to leech on the developers, and gate-keep their users.
- freeone3000 8y agoIt took a legitimate actor six months as he underwent EV certification. Even if the primary goal didn't get met, there's still the secondary goal of having problematic publishers officially blocked by cert revocation. Also, users DO get the app from the publisher in this case. Windows provides SmartScreen, the developer provided the binary and signature (and was on his own as to how to get it)
- mdip 8y agoIt took me about 3 months, but if I'm being honest -- once I got off my rump and actually gathered all of the nonsense together to get my application processed, the whole thing took about a week. The trickiest part was explaining to the 60-year-old bank teller why I needed all of these documents notarized and what they were for. I guess that's the one protection against forgery in this case -- notaries breaking the rules are dealt with pretty harshly where I live. They called me several times and her twice, but once that was done, I got an e-mail and everything was taken care of.
- deleted 8y ago[deleted]
- mdip 8y ago> Paying thousands of dollars per year just so that users can run your free software is ludicrous. While I agree that requiring code signing certificates to run free software sucks, I'm curious where the thousands of dollars a year comes from? I finally broke down and purchased a code signing certificate[0] last year. The prices varied, but I don't recall seeing any for more than $300, and I was able to get my for $100 which is valid through Windows 10 and works on everything else that uses one of these EV certs. In addition to that, I purchased a Yubikey, which I wanted anyway (and having a desire to protect my code-signing key was the excuse I was looking for to purchase one of those), bringing the total cost for the first year to $140 (and subsequent years at $100). There is certainly a time cost, and it's really fun explaining that "no, I do not have a land-line phone" and "no, I don't get bills from my mobile phone company, but I can print out what qualifies as a bill from my Project Fi page[1]" all while trying to understand the accent of the non-native-English speaker I was working with. [0] Not purely for signing open-source software, but I use it 99% of the time for signing Open Source software ... and miserable PowerShell scripts so that I don't have to remember to override the default security policy. [1] The number of eye-rolls around the security theater involved in all of this was comical. They asked for photocopies of 6 or 7 different documents, all of which would have been trivial to forge with any information I wanted if I were so inclined. The only real verification around these documents is the notary requirement -- which, at least where I live, notaries are punished harshly if they don't follow the rules.
- api 8y ago... and people wonder why web apps are conquering the world. This is how painful it is to ship software for major platforms. Windows is by far the worst. Apple and Android are a bit better but not really great.
- me1337 8y agoas a malware developer who used to work for government ( not usa ofc ) we had our malware signed genuinly with digital certificate ( we bought using fake company ) so digitial certificate doesn't protect at all!
- azinman2 8y agoCan you tell us more?
- BugsJustFindMe 8y agoThis hits me solidly in the feels. Code signing certificates are a great idea if you're a company who gets to charge me hundreds of dollars per year to say that I am who I say I am. Code signing doesn't seem so great from my perspective, because I don't want to have to pay hundreds of dollars per year to a cartel engaging in a protection racket. Unsigned code warnings are nothing more than them saying, "Gosh, it sure would be a shame if we scared away potential users (wink wink)." If the certificates were based on inspection of the actual source code and building the installer inside a trusted environment, that would be one thing, but that isn't how they get assigned. Certificates are assigned based on whether or not I want to give the trust cartel a lot of money. Fuck that.
- wolfgke 8y ago> Code signing certificates are a great idea if you're a company who gets to charge me hundreds of dollars per year to say that I am who I say I am. Code signing doesn't seem so great from my perspective, because I don't want to have to pay hundreds of dollars per year to a cartel engaging in a protection racket. An interesting solution could be that Windows users could get the ability to add additional root certificates for application sign keys to Windows installations.
- will4274 8y agoThis already exists.
- beefhash 8y agoWhat's even more problematic is when you get into the shady stuff. I believe it's clear that there are things that people have to develop anonymously for their own safety. Examples include PC tools to reverse engineer stuff, console save file editors, etc. However, precisely because those areas are so shady, it would help if there was a way to get code signing certificates of a lower pedigree but with pseudonymity. The shadier things get, the more likely there will be knockoffs with malware. The more likely there will be knockoffs with malware, the more likely some inexperienced user will accidentally get the (ill-signed) malware knockoff.
- 8y ago
- zwetan 8y ago> Install and configure weirdo bespoke software for the smart card. It opens an SSH-server-hanging popup asking for a PIN, so I can't have headless automatic builds. You can automate this with scsigntool.exe check out https://www.mgtek.com/smartcard https://www.mgtek.com/smartcard but yeah doing all this to publish signed exe under Windows is a PITA
- vortico 8y agoI haven't used Windows in 10 years, so I don't understand: What is the point of signing this binary at all? If users want to run software they know is legitimate because they can review the source on GitHub and download via HTTPS from the GitHub page, why do they have this "Windows protection" feature enabled? Wouldn't a better solution be for the project maintainer to tell the user to disable it since they're in a position of trust which is at the same level as distributing a valid binary?
- pjmlp 8y agoThat is like 1% of Windows software, only usable by users with developer background.
- SmellyGeekBoy 8y agoIt's enabled by default and AFAIK maybe even impossible to disable. Every time I have to dabble in the world of Windows these days it really depresses me. Windows 10 is really a great OS underneath but every new update seems to add more layers of crap.
- djrogers 8y agoWow, and I thought the ‘nightmare’ stories of taking several hours to get code signing working in XCode were bad. This is ridiculous!
- ninjakeyboard 8y agoAfter reading through the comments I realize I do not miss windows.
- kaivi 8y agoI've recently paid for a code signing cert from Comodo, and I'm still stuck in the process. In order to verify your company phone number, it has be shown in any of the links like : (www.dnb.com) or (www.hoovers.com) including local/national registration agencies and reputable third party databases.. So please update the Company name,address and Phone number in any one of the above web site. My company is registered in Norway, and having the company's email and domain listed in the national company registry does not help. I'm currently in SE Asia, and I have to go back to to this: [...] you can send an attestation letter signed by your attorney, Certified Public Accountant or Latin Notary (where legally recognized) verifying the telephone number. You can download sample text for the letter [...] We need Let's Encrypt for code signing. But how can we automate identity validation? Verify the e-mail address or phone number with a national registry, where possible?
- diamondo25 8y agoI tried Comodo too, but they wanted to have a legal person to sign some document (proof of existence?). Eventually, DigiCert was pretty fast in giving out a cert. Two legal documents scanned in, a copy of a passport/id and a face to face (skype) was about enough to validate that I really exist.
- Boulth 8y agoThere is one CA (forgot the name) that provides EV certs (for websites not code signing) that looks up data in national registries, they have a lot of stuff automated so it's quick and relatively cheap. So in theory it's possible for code signing. But Let's Encrypt repeatedly refuse working on code signing certs (it's not that cheap to operate as website DV).
- SyneRyder 8y agoI switched away from Comodo because of the Dun And Bradstreet requirement, and I didn't really want to support Comodo anyway after some of the shady stuff they've done. GlobalSign were able to help me, they were a bit more expensive but vastly better support than Comodo. Super friendly phone & email support. I did need to get a Yellow Pages listing for my business for them to verify me, but Yellow Pages offer a free online listing tier in Australia. You might be able to ask for a discount if their prices are a bit too high for you & you're switching from Comodo. If you must have a Comodo cert, you could try buying through K Software (http://codesigning.ksoftware.net/ http://codesigning.ksoftware.net/). Mitchell Vincent is great to deal with, and I used his services for years. He could probably have helped me deal with Comodo verification, but I was just too exasperated by Comodo's support drones.
- garganzol 8y agoLet's encrypt for code. Tie a cert to domain. Problem solved. Overall security improved.
- asasas2321323 8y agoYou can just bring you application into Windows Store and it will be "Trusted Windows Store App". They support command line apps too.