5 ms·

This alert would not show if you used SHA256 instead of SHA1, which was deprecated: https://www.globalsign.com/en/blog/microsoft-announces-updates-sha-1-code-si

This alert would not show if you used SHA256 instead of SHA1, which was deprecated: https://www.globalsign.com/en/blog/microsoft-announces-updates-sha-1-code-signing-policy/ https://www.globalsign.com/en/blog/microsoft-announces-updat... EV certs immediately gain trust: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...

gruez 8y ago
>This alert would not show if you used SHA256 instead of SHA1, which was deprecated apparently sha2 signing wasn't working for him https://news.ycombinator.com/item?id=17200491 https://news.ycombinator.com/item?id=17200491 >I would have signed with SHA-2, which for inexplicable reason is not default despite deprecation, but my signtool crashed when I enabled it.
ehsankia 8y ago
Another 6 months!
slededit 8y ago
They aren't sufficient to get rid of the slanderous message on their own - even with an EV. You need to have a bit of volume first. Makes interacting with your first few customers lots of fun.
- mnkypete 8y ago
  That's not true though. We have very little volume installs and since the EV, there has has not been one of these messages..
  - slededit 8y ago
    I've had differing experiences. Note that if you've been distributing before you got the cert part of that rep will carry over as its also a function of the exe signature.
    - mnkypete 8y ago
      I would check if something in the signing process is going wrong, refer to this (very long) SO thread: https://security.stackexchange.com/questions/109629/deprecation-of-sha1-code-signing-certificates-on-windows/113114#113114 https://security.stackexchange.com/questions/109629/deprecat... We actually switched certificates (from StartCom to Globalsign) and the signing was wrong at first, so the message kept showing. When we fixed it, it went away immediately, even though certificate and author name changed... Here's the article:https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma... "Programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher."

gruez 8y ago

>This alert would not show if you used SHA256 instead of SHA1, which was deprecated apparently sha2 signing wasn't working for him https://news.ycombinator.com/item?id=17200491 https://news.ycombinator.com/item?id=17200491 >I would have signed with SHA-2, which for inexplicable reason is not default despite deprecation, but my signtool crashed when I enabled it.

ehsankia 8y ago

Another 6 months!

slededit 8y ago

They aren't sufficient to get rid of the slanderous message on their own - even with an EV. You need to have a bit of volume first. Makes interacting with your first few customers lots of fun.

mnkypete 8y ago
That's not true though. We have very little volume installs and since the EV, there has has not been one of these messages..
- slededit 8y ago
  I've had differing experiences. Note that if you've been distributing before you got the cert part of that rep will carry over as its also a function of the exe signature.
  - mnkypete 8y ago
    I would check if something in the signing process is going wrong, refer to this (very long) SO thread: https://security.stackexchange.com/questions/109629/deprecation-of-sha1-code-signing-certificates-on-windows/113114#113114 https://security.stackexchange.com/questions/109629/deprecat... We actually switched certificates (from StartCom to Globalsign) and the signing was wrong at first, so the message kept showing. When we fixed it, it went away immediately, even though certificate and author name changed... Here's the article:https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma... "Programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher."