5 ms·

A code signing cert only removes the warning during actual installation, after you've already downloaded it. For new software, Microsoft still flags it as "unco

A code signing cert only removes the warning during actual installation, after you've already downloaded it. For new software, Microsoft still flags it as "uncommon", even if a code signing cert was used. Not sure if an EV cert makes a difference as you say, but they are certainly prohibitively expensive.

wongarsu 7y ago
SmartScreen is Microsoft's reputation system used both in IE (since IE9), Edge, and Windows 8 and 10. [1] is an introductory blog article about the system in general, revealing among other things that both the executable and the cert it's signed with gather reputation. [2] goes into some more detail on code signing, and [3] talks about EV certs (basically they are a massive reputation boost, both starting you higher (high enough to bypass the warning) and letting you gain reputation faster). A regular code signing cert can be bought for about $6/month, and an EV cert for about $25/month (if you shop around or buy multi-year certs). Both are expensive in the context of open source, but I'm not sure I'd call the cost prohibitive. 1: https://blogs.msdn.microsoft.com/ie/2010/10/13/stranger-danger-introducing-smartscreen-application-reputation/ https://blogs.msdn.microsoft.com/ie/2010/10/13/stranger-dang... 2: https://blogs.msdn.microsoft.com/ieinternals/2011/03/22/everything-you-need-to-know-about-authenticode-code-signing/ https://blogs.msdn.microsoft.com/ieinternals/2011/03/22/ever... 3: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...
- razakel 7y ago
  >A regular code signing cert can be bought for about $6/month Where?
  - wongarsu 7y ago
    https://comodosslstore.com/code-signing https://comodosslstore.com/code-signing (well, you have to pay yearly since it's a yearly cert, but it comes out to $6/month)
  - GordonS 7y ago
    I got a 4-year cert from K Software for $234 (which is < $5 month). Of course, I had to pay for 4 years up-front, but TBH I'd much prefer that, as the verification process is a series of time-consuming farcical hoops to jump through.

wongarsu 7y ago

SmartScreen is Microsoft's reputation system used both in IE (since IE9), Edge, and Windows 8 and 10. [1] is an introductory blog article about the system in general, revealing among other things that both the executable and the cert it's signed with gather reputation. [2] goes into some more detail on code signing, and [3] talks about EV certs (basically they are a massive reputation boost, both starting you higher (high enough to bypass the warning) and letting you gain reputation faster). A regular code signing cert can be bought for about $6/month, and an EV cert for about $25/month (if you shop around or buy multi-year certs). Both are expensive in the context of open source, but I'm not sure I'd call the cost prohibitive. 1: https://blogs.msdn.microsoft.com/ie/2010/10/13/stranger-danger-introducing-smartscreen-application-reputation/ https://blogs.msdn.microsoft.com/ie/2010/10/13/stranger-dang... 2: https://blogs.msdn.microsoft.com/ieinternals/2011/03/22/everything-you-need-to-know-about-authenticode-code-signing/ https://blogs.msdn.microsoft.com/ieinternals/2011/03/22/ever... 3: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...

razakel 7y ago
>A regular code signing cert can be bought for about $6/month Where?
- wongarsu 7y ago
  https://comodosslstore.com/code-signing https://comodosslstore.com/code-signing (well, you have to pay yearly since it's a yearly cert, but it comes out to $6/month)
- GordonS 7y ago
  I got a 4-year cert from K Software for $234 (which is < $5 month). Of course, I had to pay for 4 years up-front, but TBH I'd much prefer that, as the verification process is a series of time-consuming farcical hoops to jump through.