12 ms·
Windows signing is a ripoff, $500/year you're getting nothing. Your certificate is not trusted. You have to "get reputation for it" before Windows Defender woul
by Svoka 8y ago
Windows signing is a ripoff, $500/year you're getting nothing.
Your certificate is not trusted. You have to "get reputation for it" before Windows Defender would stop giving users warnings.
Also, renewing certificate is not a thing. Every time you have to get a new one, with same story of "reputation" again.
[1] https://www.digicert.com/order/order-1.php https://www.digicert.com/order/order-1.php
- Sephr 8y agoThere's a backdoor that lets your bypass the SmartScreen reputation requirement: pay more money for an EV cert[1]. I don't agree with this industry practice. Reputation requirements either shouldn't have backdoors or shouldn't exist in the first place. 1. https://twitter.com/JosephRyanRies/status/951643158118567937 https://twitter.com/JosephRyanRies/status/951643158118567937
- Someone1234 8y agoThe Reputation requirement exists simply because there's CAs in the Windows certificate store that aren't super trustworthy, and frankly that malware could seek to get a code signing certificate. Arguably the Reputation requirement is more helpful than the information held in the certificate, since Reputation is hard to fake whereas that information is provided by the requestor and its validation depends on the CA's processes (which as I said varies wildly). It is one of those "greater good" things. It does suck for FOSS however.
- Sephr 8y agoI'm not arguing against reputation requirements, I'm arguing for consistency. EV certificates are literally a reputation requirement backdoor. If EV-signed apps had to deal with the same SmartScreen reputation requirements as non-EV-signed apps, Microsoft might actually have to address this issue brought up in the parent comment: > Every time you have to get a new one, with same story of "reputation" again.
- Boulth 8y agoEV code signing certs cost more because they require the private key to be stored exclusively on the hardware token so it's harder to misuse.
- Svoka 8y agoI can not stick EV token into my cloud VPS build server.
- GordonS 8y agoYou can get a certificate far cheaper than that - K-Software offer them for $85/year. I've used them for years and can recommend them.
- Sephr 8y agoK-Software does not sell EV certificates for $85/yr. They start at $349/yr. The parent comment's issue is that EV certificates are essentially required due to the poorly-designed SmartScreen reputation filter. The $85/yr certificate you're mentioning doesn't help solve this.
- GordonS 8y agoI didn't know about the EV workaround and the OP didn't mention it. I've never used an EV cert before for code signing. When we first started, I think Smartscreen was a nuisance for about 2 weeks, but years on, and I've never had to think about it again. Even when we've renewed the cert.
- Boulth 8y agoThanks for taking the time to describe your experience. When you renewed the cert did you use the same key pair? (I'm wondering how does Microsoft correlate reputation).
- flohofwoe 8y ago
- juliusmusseau 8y agoFunny thing about trust: I trust a developer who drops some $$$ on a code-signing certificate more than I trust a developer who doesn't. Even if it's just $20. Also, the validation requirements to obtain a code-signing certificate, while certainly not bulletproof, are not nothing: you need to send in articles of incorporation and your business needs a listing with a physical address and phone number in a public directory (e.g., bbb.org), and someone representing your business needs to pick up that phone when the cert validator calls it. Your business name and physical address are injected into the certificate. Basically code-signing certificates make it easier for people to find you and sue you if they truly want to. I suspect that's the whole point. The problem here is that the Notepad++ developer wants his certificate to say CN=Notepad++, but he won't be able to obtain that until he has some kind of business or organization registered in his jurisdiction with that name. Whereas CN=FIRSTNAME LASTNAME he could probably obtain immediately (just send in his driver's license during validation).
- Sephr 8y ago> Even if it's just $20. $20 doesn't get you an EV certificate anywhere. We're talking about non-trivial hundreds of dollars per year, which is completely unsustainable for an open source driver for example.
- juliusmusseau 8y agoMy point was I would trust someone who drops $20 more than I would trust someone who drops nothing. $61/yr (USD) will get you an OV cert - there are 10% discount codes that are easy to find for these guys, and their list price is $67/yr: https://codesigning.ksoftware.net/ https://codesigning.ksoftware.net/ But the Notepad++ guy will need a business registered with that name before he can obtain CN=Notepad++, no matter how much he's willing to pay.
- ex3ndr 8y agoThis certificate doesn't help to bypass UAC and "unsecure" prompt still be shown to the user.
- Twisell 8y agoWait are you saying that Apple Developer program for 99$/year is actually quite a good deal in comparison? I will definitely pull this thread out next time someone complain that Apple is too expensive and that they are milking the poor developers...
- Godel_unicode 8y agoYou can deliver unsigned Windows apps.
- eridius 8y agoYou can deliver unsigned Mac apps too, just not on the MAS.
- 43920 8y agoRunning an unsigned app requires a separate option that's reasonably well-hidden, however [0], so it's difficult to avoid the signing requirement if you're going to distribute your app to a wide audience. [0] https://www.macworld.com/article/3140183/how-to-install-an-app-in-macos-sierra-thats-not-signed-by-a-developer.html https://www.macworld.com/article/3140183/how-to-install-an-a...
- dchest 8y agoThe are blocked by default from the latest two of three versions of macOS. You'll have to explain your users to right-click on the app icon and click Open to launch your app.
- 43920 8y agoThey're both too expensive? (The only acceptable price is $0, IMO.)
- robinwassen 8y agoYou can buy a Comodo Code Sign cert for $95 if you buy from a reseller rather than direct.
- moonshinefe 8y agoI have to say I agree here. Notepad++ if it provides hashes for the downloaded EXEs is completely in the right for not wanting to pay middle men for fancy "this is OK" screen on installation. That seems ridiculous and greedy.
- huhtenberg 8y ago> Also, renewing certificate is not a thing. Oh, no. We just kept renewing our EV certs with them for past several years... if only we'd known that we can't. Damn. Such an amateur shop this Digicert. Unacceptable.
- Svoka 8y agoYou are getting new EV certificate every time.
- Tsubasachan 8y agoAt least Windows lets you install pretty much whatever you want. None of this nonsense is mandatory.
- laythea 8y agoShhh! Don't give them ideas! :)
- Svoka 8y agoNot from my experience. Many Windows users have anti-viruses installed, and they flag unsigned soft. I'm speaking from experience: it is cheaper to buy pricy certificate than loose big chunks of customers because of Windows Defender warnings. This is especially problem if you have software with rapid development cycle. Like I do - we got daily builds going up every couple days or so. Also, Windows "trust system" seemingly works also on unsigned binaries. If you don't disable bunch of security settings, you would be blocked similar to self-signed certificates on HTTPS. You can go around, by clicking tiny button. Is enough users do it, software getting flagged as OK. Certificate solves that this should be done per certificate, not per binary.