9 ms·

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive co

I get the sentiment here, it's very annoying for developers (including me). Establishing trust is very hard problem, though. Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs -- https://yourbank.real-secure-website.xy https://yourbank.real-secure-website.xy can have a valid cert but it doesn't mean it's legitimate. What's the equivalent to the "URL bar" for software? What's the equivalent to the ACME domain validation challenge? The SmartScreen stuff is another attempt at this -- software that's not frequently seen is flagged as a potential problem. As a developer, this annoys me greatly. As the de-facto support person for family that don't understand computers... I don't mind so much. Without this, malware gets executed directly and now you're dependent on (very imperfect) anti-virus software. I guess the Store is another way to have "trusted" applications, but you only have to look at the Google Play or iOS store to see how well this ultimately works out (for both malware and legitimate authors). Note this isn't even about admin vs non-admin installations. Obviously malware running as admin can do more damage that's harder to recover from, but non-admin malware is just as capable of doing bad things (think: stealing credentials, running cryptocurrency miners, ransomware), and after being hit by a randomware attack I doubt your "typical" user is going to really care much about the distinction between their account vs the entire computer being trashed.

an_d_rew 6y ago
Absolutely. I think it's easy for the HN crowd to inadvertently forget what computers / phones / tablets / TVs look like to ordinary people. I would encourage people to come up with actual use-cases and pro-con scenarios rather than 100% "emotion mind" opinions.
- bitL 6y ago
  So what? We are developers, we are affected, we are making ourselves heard. We aren't our users (designer's motto). It took me about 15 minutes to get my Android Phone infected by a malware by downloading just apps from Google Play. If Google is failing in such basic task for "ordinary people", all MS accomplishes is to annoy regular developers, making their apps "suspicious" to the public.
- Asooka 6y ago
  I don't believe any computer-illiterate people use Windows. Tablets and phones have completely replaced PCs in ordinary people's lives, with macbooks serving for the tiny percentage of tasks that need a keyboard. Anyone trying to use Windows as a "normal person" quickly runs into a bunch of random issues and edge cases, e.g. I recently realised that my microphone doesn't work right because I was plugging it into a USB3 port instead of a USB2 one. Microsoft drivers, everyone. You have nVidia drivers leaving all their previous versions installed on every update requiring use of a third party tool to clean your constantly growing C drive. You have just random driver crashes from random device manufacturers. You have at least two different control panels for every thing. And on and on. It is nearly impossible to use Windows unless you're a power user and know its workings, or have someone else administer your PC and only run MSOffice and Outlook. That said, Smart Screen is a useful feature, I do want to know if the program I downloaded was not signed by the developer. What I would like from it however is that it should show up on every install with either "This program is signed by Malbolge Inc." or "This program does not have a signature" (in bold on bright red background with big exclamation marks border); "Do you wish to install?". Every installer gets this popup, nobody is spared. For the unsigned case, maybe require two clicks - a checkbox and a button. Because I always want to know who signed the installer, just in case I downloaded a compromised installer signed by a certificate different from what I expect. It also makes the unsigned installer popup less scary in comparison, though it must be kept visually distinct from the signed installer popup. For individual portable programs that are not installed, you will also have a "do not ask again" checkbox. Again, this will pop up for every program at least once.
umvi 6y ago
> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? They can keep SmartScreen in place, but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source.
- gruez 6y ago
  >but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source I'm not sure whether that helps. The dunning-kruger effect will invariably cause novice users to skip those warnings because they think they "know computers", and "wouldn't fall for scams".
- smacktoward 6y ago
  Every single person who installed Bonzi Buddy thought they were getting it from a good source.
  - ebg13 6y ago
    Bonzi Buddy, as a money making enterprise, would have paid for a signing certificate as a cost of business. This does not save you from Bonzi Buddy.
    - criddell 6y ago
      Sure, Bonzi Buddy might not be the best example, but you get his point. People just click through dialogs to close them without thinking about what they are clicking.
      - ebg13 6y ago
        You don't get to handwave away a clear fallacy with "ok but you get the point". _My_ point is that the point is false, not that the example is bad. If Bonzi Buddy can just buy their way into your computer, then this does not save you. From anything. Because real malicious actors like Bonzi Buddy can just buy their way in!
Avamander 6y ago
> Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs IMO that would still be good. This would help protect against dangerous middlemen, all those massive sites containing thousands of pieces of software, many with added ad- or other badware. If CCleaner (just an random example) could sign their executables for free, then there'd be a very justified suspicion if it isn't signed. Not to mention, does the existence of a cert really make a piece of (proprietary) software trustworthy?
- 411111111111111 6y ago
  > This would help protect against dangerous middlemen but if everyone can get their certificate, they can always just sign it with their own...
  - Avamander 6y ago
    Yes, true. But it would be an additional hurdle and any weirdness like that is visible. Plus MS or AV vendors could blacklist actual signers that misbehave.
- donmcronald 6y ago
  > does the existence of a cert really make a piece of (proprietary) software trustworthy? Nope. I’d even goes as far as to say the majority of malware and other crap you don’t want on your PC is signed these days.
xoail 6y ago
Just do what Apple does. Own the certification and recognize trustworthy developers. Allow new devs to easily distribute and ban/block them if they turn malicious. Its not a perfect solution but is in the right direction IMHO.
- jimnotgym 6y ago
  And if Apple make a mistake and exclude you from the market incorrectly who does one appeal to? I would rather Windows didn't become another walled garden.
ebg13 6y ago
> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking up what I'm putting down, great. I also care about my users, so I'll happily mark my applications. But you don't need to take $100/year from me for the right to not have thugs block access. > Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. Malware exists to make money. Therefore malware authors can easily pay for certificates as a cost of business. Megacorp software fucks people over all the time. It exfiltrates their browsing history, MITMs their secure connections, installs rootkits and backdoors. Please don't pretend that this increases security.
- fh973 6y ago
  Not that simple to just pay. You need an EV certificate (https://en.m.wikipedia.org/wiki/Extended_Validation_Certificate https://en.m.wikipedia.org/wiki/Extended_Validation_Certific...), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.
  - ebg13 6y ago
    Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.
    - lima 6y ago
      What usually happens is that legitimate certificates are stolen.
      - 6y ago
falcolas 6y ago
> software that's not frequently seen is flagged as a potential problem Which means it’s not frequently seen, which means it’s flagged, which means it’s not frequently seen, which means... One simple solution is don’t flag “not frequently seen” with the “interfere with installation” flag. Ditto developer certificates. Does it open up a potential attack vector? Yes. But it removes an algorithmic, uncompromising, and artificial hurdle for independent developers, which is better for users IMO.
acaloiar 6y ago
> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Microsoft can recognize that pay-to-play certificates are merely assets owned by developers; not developer identities. Microsoft needs to manage identity relationships with developers in a way that is indepdent of certificate aquisition and expiry. The certificates themselves are merely an implementation detail of identity. With that said, I don't condone the corporate gate-keeping of software development and recommend developers not contribute to any platform that requires indie developers to pay to become a part of the ecosystem. Long live open source.
mkup 6y ago
Microsoft can give out free code-signing certificates like LetsEncrypt, but bind publisher reputation to the domain name, rather than to a particular public key or certificate. In such way, malware makers won't be able to build up enough reputation, because they will have to switch domain names often (and legit software publishers won't be subjects to extortion by Code Signing CAs). Regarding domain expiry problem, this is solved by short-lived certificates (same as for LetsEncrypt) and timestamping server.
- captn3m0 6y ago
  This enforces a "developers-must-own-and-continue-to-own-a-domain". Not saying that's bad, but it needs to be considered. for eg A lot of software these days is built and served entirely from GitHub. You could even end up re-using domain-name-signals from existing spam datasets (whois, hosting provider, age etc).
  - Wowfunhappy 6y ago
    > This enforces a "developers-must-own-and-continue-to-own-a-domain". Not saying that's bad I'll come out and say it's bad... but also much better than the current situation. So as a compromise I'm all for it!
  - mopsi 6y ago
    > A lot of software these days is built and served entirely from GitHub. The identity could also be tied to Github accounts, among other options.
  - donmcronald 6y ago
    A domain is $10-$20 / year. I’ll take that over $500 / year EV code signing certificates.
- donmcronald 6y ago
  Yes. Domains, long lived private keys, developer accounts, etc. are all better than the current system. If timestamp countersigning were replaced with some kind of domain based validation we could have short lived keys and the whole thing could be tied back to a digital identity that’s more trustworthy than Malware Inc.’s EV code signing certificate.
jedberg 6y ago
> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Do what Apple does -- allow me as a user to set a setting that allows unsigned code to run, or allows signed but not recognized code to run, but with a warning that it is signed but not recognized. They could also fix their warning screen to better explain that it's not necessarily malware.
- kevingadd 6y ago
  Windows already works the way you describe. There's a Developer Mode that relaxes some restrictions and SmartScreen lets you run unsigned code even in its default configuration (you have to click More Info to show the button, which is annoying but hardly unique to Windows - security error bypass in most browsers has been this way for ages)
  - kroltan 6y ago
    SmartScreen's current behaviour is more like if browsers pretended HTTP is a security error (It is not. It is just insecure, and labeled as such) and required the same bypass workflow.
jfkebwjsbx 6y ago
There is no solution to the problem except a curated list. EV certs should be a one-time payment thing, reasonable price ($100, for example) and require paperwork to link it to a business or individual. Same as the "blue tick" in social apps. That doesn’t stop everything, but at least it is not the wild west either.
deleted 6y ago
[deleted]
blablabla123 6y ago
> What's the equivalent to the "URL bar" for software? What's the equivalent to the ACME domain validation challenge? It's quite ironic that JavaScript is practically a native language on Windows since Windows 8. Either it's indeed not possible to use LetsEncrypt for that or they marketed it wrong to developers. I'm amazed how MS is often the first one to push out new Desktop technology a decade before everyone else (HTML on the desktop, AJAX) but it's usually others that take full advantage of those on other platforms...
jimmaswell 6y ago
It was a better situation when anything would just run. Defender scans for known malware and that should be enough.
Mindwipe 6y ago
> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Decentralise the signing authority so there are multiple different independent sources and they lose editorial control and monopoly pricing.
tobias3 6y ago
For open source apps: Perhaps have a build service (Azure+github) that builds the software from source, then automatically signs it. Perhaps have some kind of application + manual review + requirements (like Github 2FA) process. Scanning for malicious source code would help a small bit as well. For individuals: Some countries have an electronic identity system (eID), that would allow verification of name + address when code signing while being as secure/more secure than the usb sticks one gets for an EV certificate + the EV address/identity verification process. Because there is no standard this would be a lot of per-country work. And some countries don't have a (good) eID system (or an ID system at all). I only know the technical details of the German one and that one would work. For businesses: EV certificates shouldn't be too much of a cost there. Though I am annoyed by the lack of competition driving the prices down in this area. Maybe make it easier for new authorities to enter the market?
- mjevans 6y ago
  To start with, the shared libraries (DLLs SOs, whatever) should be something MS makes easy for their authors to get inside of an official package distribution channel. For Windows that happens to be the 'Microsoft Store' and they should be free (as in beer). That would then let MS worry about only the business logic and other glue using that already trustworthy or at least trust-rated code. That too, if it's free of charge software, should have ways of being published that make it easier to verify something is safe, and if it's questionable, then engage in more of a process.
bob1029 6y ago
What did we do before we needed corporations to tell us what is safe and unsafe for consumption? Even as late as 2010 I cannot recall some e-nanny telling me that I downloaded a naughty executable image. I do not recall anyone having a life-altering problem due to lack of such a system, but I only know so many people. Any way you slice this it's more about profit than it is about security. There is no amount of locking-down of Windows that will prevent my friends and family from figuring out how to completely fuck up the machine anyways and everyone involved knows it. We were literally just talking about how awesome it would be to dumpster Apple's iOS ecosystem in favor of a .NET/Surface ecosystem, but if its going to be the same enterprise signing certificate hell, then Microsoft can fuck directly off too. I am so tired of this shit. We have spent the last 2 weeks fighting Apple certificate nonsense on behalf of several of our customers. Apple, Microsoft, and others who would force code signing identities on developers: Kindly fuck off with your nonsense. We would like to get back to writing code and delivering excellent customer experiences. Trust can be built in many other ways. You are not the sole arbiters of trust. I would much more likely follow advice from a green username on HN than I would your smartscreen technology or any ridiculous certificate chain backing it.
inimino 6y ago
> Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? They could prioritize the radical concept that the owner of the hardware also takes responsibility for the software that runs on it, and they could make efforts to inform, educate, and empower the owner, rather than wrest power away from them and from independent developers. They could copy Debian and other orgs that solved many distribution and trust problems decades ago while remaining free for both users and developers, with only volunteer resources, while MS users were still stuck with random .exe's from random websites and shrinkwrapped software as the only options. And those of us who really ought to know better could stop acting like this is some best-effort genuine desire to solve truly hard problems on behalf of users, rather than the shameless power-grab it actually is.
Leace 6y ago
Allow self-signed certs and build reputation as usual. This would still require effort from indie devs to build reputation but as soon as more people start using your app the dialogs disappear. You don't need domain name, anyone can generate self-signed certs. One variation of this scheme is making Microsoft the CA that issues certs for free with some issuance limits. For the record Google uses self-signed certs for Android apps.

an_d_rew 6y ago

Absolutely. I think it's easy for the HN crowd to inadvertently forget what computers / phones / tablets / TVs look like to ordinary people. I would encourage people to come up with actual use-cases and pro-con scenarios rather than 100% "emotion mind" opinions.

bitL 6y ago
So what? We are developers, we are affected, we are making ourselves heard. We aren't our users (designer's motto). It took me about 15 minutes to get my Android Phone infected by a malware by downloading just apps from Google Play. If Google is failing in such basic task for "ordinary people", all MS accomplishes is to annoy regular developers, making their apps "suspicious" to the public.
Asooka 6y ago
I don't believe any computer-illiterate people use Windows. Tablets and phones have completely replaced PCs in ordinary people's lives, with macbooks serving for the tiny percentage of tasks that need a keyboard. Anyone trying to use Windows as a "normal person" quickly runs into a bunch of random issues and edge cases, e.g. I recently realised that my microphone doesn't work right because I was plugging it into a USB3 port instead of a USB2 one. Microsoft drivers, everyone. You have nVidia drivers leaving all their previous versions installed on every update requiring use of a third party tool to clean your constantly growing C drive. You have just random driver crashes from random device manufacturers. You have at least two different control panels for every thing. And on and on. It is nearly impossible to use Windows unless you're a power user and know its workings, or have someone else administer your PC and only run MSOffice and Outlook. That said, Smart Screen is a useful feature, I do want to know if the program I downloaded was not signed by the developer. What I would like from it however is that it should show up on every install with either "This program is signed by Malbolge Inc." or "This program does not have a signature" (in bold on bright red background with big exclamation marks border); "Do you wish to install?". Every installer gets this popup, nobody is spared. For the unsigned case, maybe require two clicks - a checkbox and a button. Because I always want to know who signed the installer, just in case I downloaded a compromised installer signed by a certificate different from what I expect. It also makes the unsigned installer popup less scary in comparison, though it must be kept visually distinct from the signed installer popup. For individual portable programs that are not installed, you will also have a "do not ask again" checkbox. Again, this will pop up for every program at least once.

umvi 6y ago

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? They can keep SmartScreen in place, but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source.

gruez 6y ago
>but soften the language and make it more obvious that you can still run it if you are sure you got it from a good source I'm not sure whether that helps. The dunning-kruger effect will invariably cause novice users to skip those warnings because they think they "know computers", and "wouldn't fall for scams".
smacktoward 6y ago
Every single person who installed Bonzi Buddy thought they were getting it from a good source.
- ebg13 6y ago
  Bonzi Buddy, as a money making enterprise, would have paid for a signing certificate as a cost of business. This does not save you from Bonzi Buddy.
  - criddell 6y ago
    Sure, Bonzi Buddy might not be the best example, but you get his point. People just click through dialogs to close them without thinking about what they are clicking.
    - ebg13 6y ago
      You don't get to handwave away a clear fallacy with "ok but you get the point". _My_ point is that the point is false, not that the example is bad. If Bonzi Buddy can just buy their way into your computer, then this does not save you. From anything. Because real malicious actors like Bonzi Buddy can just buy their way in!

Avamander 6y ago

> Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs IMO that would still be good. This would help protect against dangerous middlemen, all those massive sites containing thousands of pieces of software, many with added ad- or other badware. If CCleaner (just an random example) could sign their executables for free, then there'd be a very justified suspicion if it isn't signed. Not to mention, does the existence of a cert really make a piece of (proprietary) software trustworthy?

411111111111111 6y ago
> This would help protect against dangerous middlemen but if everyone can get their certificate, they can always just sign it with their own...
- Avamander 6y ago
  Yes, true. But it would be an additional hurdle and any weirdness like that is visible. Plus MS or AV vendors could blacklist actual signers that misbehave.
donmcronald 6y ago
> does the existence of a cert really make a piece of (proprietary) software trustworthy? Nope. I’d even goes as far as to say the majority of malware and other crap you don’t want on your PC is signed these days.

xoail 6y ago

Just do what Apple does. Own the certification and recognize trustworthy developers. Allow new devs to easily distribute and ban/block them if they turn malicious. Its not a perfect solution but is in the right direction IMHO.

jimnotgym 6y ago
And if Apple make a mistake and exclude you from the market incorrectly who does one appeal to? I would rather Windows didn't become another walled garden.

ebg13 6y ago

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I'll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they're picking up what I'm putting down, great. I also care about my users, so I'll happily mark my applications. But you don't need to take $100/year from me for the right to not have thugs block access. > Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. Malware exists to make money. Therefore malware authors can easily pay for certificates as a cost of business. Megacorp software fucks people over all the time. It exfiltrates their browsing history, MITMs their secure connections, installs rootkits and backdoors. Please don't pretend that this increases security.

fh973 6y ago
Not that simple to just pay. You need an EV certificate (https://en.m.wikipedia.org/wiki/Extended_Validation_Certificate https://en.m.wikipedia.org/wiki/Extended_Validation_Certific...), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.
- ebg13 6y ago
  Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.
  - lima 6y ago
    What usually happens is that legitimate certificates are stolen.
    - 6y ago

falcolas 6y ago

> software that's not frequently seen is flagged as a potential problem Which means it’s not frequently seen, which means it’s flagged, which means it’s not frequently seen, which means... One simple solution is don’t flag “not frequently seen” with the “interfere with installation” flag. Ditto developer certificates. Does it open up a potential attack vector? Yes. But it removes an algorithmic, uncompromising, and artificial hurdle for independent developers, which is better for users IMO.

acaloiar 6y ago

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Microsoft can recognize that pay-to-play certificates are merely assets owned by developers; not developer identities. Microsoft needs to manage identity relationships with developers in a way that is indepdent of certificate aquisition and expiry. The certificates themselves are merely an implementation detail of identity. With that said, I don't condone the corporate gate-keeping of software development and recommend developers not contribute to any platform that requires indie developers to pay to become a part of the ecosystem. Long live open source.

mkup 6y ago

Microsoft can give out free code-signing certificates like LetsEncrypt, but bind publisher reputation to the domain name, rather than to a particular public key or certificate. In such way, malware makers won't be able to build up enough reputation, because they will have to switch domain names often (and legit software publishers won't be subjects to extortion by Code Signing CAs). Regarding domain expiry problem, this is solved by short-lived certificates (same as for LetsEncrypt) and timestamping server.

captn3m0 6y ago
This enforces a "developers-must-own-and-continue-to-own-a-domain". Not saying that's bad, but it needs to be considered. for eg A lot of software these days is built and served entirely from GitHub. You could even end up re-using domain-name-signals from existing spam datasets (whois, hosting provider, age etc).
- Wowfunhappy 6y ago
  > This enforces a "developers-must-own-and-continue-to-own-a-domain". Not saying that's bad I'll come out and say it's bad... but also much better than the current situation. So as a compromise I'm all for it!
- mopsi 6y ago
  > A lot of software these days is built and served entirely from GitHub. The identity could also be tied to Github accounts, among other options.
- donmcronald 6y ago
  A domain is $10-$20 / year. I’ll take that over $500 / year EV code signing certificates.
donmcronald 6y ago
Yes. Domains, long lived private keys, developer accounts, etc. are all better than the current system. If timestamp countersigning were replaced with some kind of domain based validation we could have short lived keys and the whole thing could be tied back to a digital identity that’s more trustworthy than Malware Inc.’s EV code signing certificate.

jedberg 6y ago

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Do what Apple does -- allow me as a user to set a setting that allows unsigned code to run, or allows signed but not recognized code to run, but with a warning that it is signed but not recognized. They could also fix their warning screen to better explain that it's not necessarily malware.

kevingadd 6y ago
Windows already works the way you describe. There's a Developer Mode that relaxes some restrictions and SmartScreen lets you run unsigned code even in its default configuration (you have to click More Info to show the button, which is annoying but hardly unique to Windows - security error bypass in most browsers has been this way for ages)
- kroltan 6y ago
  SmartScreen's current behaviour is more like if browsers pretended HTTP is a security error (It is not. It is just insecure, and labeled as such) and required the same bypass workflow.

jfkebwjsbx 6y ago

There is no solution to the problem except a curated list. EV certs should be a one-time payment thing, reasonable price ($100, for example) and require paperwork to link it to a business or individual. Same as the "blue tick" in social apps. That doesn’t stop everything, but at least it is not the wild west either.

deleted 6y ago

[deleted]

blablabla123 6y ago

> What's the equivalent to the "URL bar" for software? What's the equivalent to the ACME domain validation challenge? It's quite ironic that JavaScript is practically a native language on Windows since Windows 8. Either it's indeed not possible to use LetsEncrypt for that or they marketed it wrong to developers. I'm amazed how MS is often the first one to push out new Desktop technology a decade before everyone else (HTML on the desktop, AJAX) but it's usually others that take full advantage of those on other platforms...

jimmaswell 6y ago

It was a better situation when anything would just run. Defender scans for known malware and that should be enough.

Mindwipe 6y ago

> What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? Decentralise the signing authority so there are multiple different independent sources and they lose editorial control and monopoly pricing.

tobias3 6y ago

For open source apps: Perhaps have a build service (Azure+github) that builds the software from source, then automatically signs it. Perhaps have some kind of application + manual review + requirements (like Github 2FA) process. Scanning for malicious source code would help a small bit as well. For individuals: Some countries have an electronic identity system (eID), that would allow verification of name + address when code signing while being as secure/more secure than the usb sticks one gets for an EV certificate + the EV address/identity verification process. Because there is no standard this would be a lot of per-country work. And some countries don't have a (good) eID system (or an ID system at all). I only know the technical details of the German one and that one would work. For businesses: EV certificates shouldn't be too much of a cost there. Though I am annoyed by the lack of competition driving the prices down in this area. Maybe make it easier for new authorities to enter the market?

mjevans 6y ago
To start with, the shared libraries (DLLs SOs, whatever) should be something MS makes easy for their authors to get inside of an official package distribution channel. For Windows that happens to be the 'Microsoft Store' and they should be free (as in beer). That would then let MS worry about only the business logic and other glue using that already trustworthy or at least trust-rated code. That too, if it's free of charge software, should have ways of being published that make it easier to verify something is safe, and if it's questionable, then engage in more of a process.

bob1029 6y ago

What did we do before we needed corporations to tell us what is safe and unsafe for consumption? Even as late as 2010 I cannot recall some e-nanny telling me that I downloaded a naughty executable image. I do not recall anyone having a life-altering problem due to lack of such a system, but I only know so many people. Any way you slice this it's more about profit than it is about security. There is no amount of locking-down of Windows that will prevent my friends and family from figuring out how to completely fuck up the machine anyways and everyone involved knows it. We were literally just talking about how awesome it would be to dumpster Apple's iOS ecosystem in favor of a .NET/Surface ecosystem, but if its going to be the same enterprise signing certificate hell, then Microsoft can fuck directly off too. I am so tired of this shit. We have spent the last 2 weeks fighting Apple certificate nonsense on behalf of several of our customers. Apple, Microsoft, and others who would force code signing identities on developers: Kindly fuck off with your nonsense. We would like to get back to writing code and delivering excellent customer experiences. Trust can be built in many other ways. You are not the sole arbiters of trust. I would much more likely follow advice from a green username on HN than I would your smartscreen technology or any ridiculous certificate chain backing it.

inimino 6y ago

> Let's move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn't result in an identical or worse situation? They could prioritize the radical concept that the owner of the hardware also takes responsibility for the software that runs on it, and they could make efforts to inform, educate, and empower the owner, rather than wrest power away from them and from independent developers. They could copy Debian and other orgs that solved many distribution and trust problems decades ago while remaining free for both users and developers, with only volunteer resources, while MS users were still stuck with random .exe's from random websites and shrinkwrapped software as the only options. And those of us who really ought to know better could stop acting like this is some best-effort genuine desire to solve truly hard problems on behalf of users, rather than the shameless power-grab it actually is.

Leace 6y ago

Allow self-signed certs and build reputation as usual. This would still require effort from indie devs to build reputation but as soon as more people start using your app the dialogs disappear. You don't need domain name, anyone can generate self-signed certs. One variation of this scheme is making Microsoft the CA that issues certs for free with some issuance limits. For the record Google uses self-signed certs for Android apps.