5 ms·

I call BS. This might be hurting some hobbyist projects, but anybody who earns their living publishing software, and gets even a small amount of those earnings

I call BS. This might be hurting some hobbyist projects, but anybody who earns their living publishing software, and gets even a small amount of those earnings from Windows apps, can afford $100/year for a code signing certificate. There are a lot of people trying really hard to trick users into installing software they don't want. There's big money in it. Authenticode strikes me as an entirely reasonable step to provide more signal to the systems trying to identify and block crapware.

colde 6y ago
But why even require payment for these certificates, since Microsoft according to the article doesn't actually place any value on the certificate itself. You still have to build up reputation separately. In that case, it seems entirely unnecessary to require a paid certificate.
- repiret 6y ago
  Because it costs money to do the identify verification? Its not like a DV certificate where the volume is very high, and the verification isn't hard to automate. I paid $400/yr for my employers first Authenticode certificate back when they were a new thing and you could only get them from Verisign. Now there's a handful of providers and competition has brought the price down, but the volume is lower than DV certs, and verification is harder, so the prices won't go down to zero. Why do identity verification at all, you could ask? A reasonable question; if all I need to start earning reputation is a private key, the costs could go to zero. But letting the scammers make as many identities as they like at no cost changes the prior on a previously unseen identity. It seems MS isn't granting a very strong prior anyway though, so... my argument certainly is weak here.
voltagex_ 6y ago
$100 USD
- repiret 6y ago
  Yes. I'll accept that thats a lot of money in some places of the world, but thats less than half a day of time for a skilled Windows developer no matter where they live.
  - fomine3 6y ago
    So we need to become skilled Windows developer before buy a certificate.
    - repiret 6y ago
      If you're not a skilled windows developer, what use is the certificate?
      - fomine3 6y ago
        Amateur developer shouldn't distribute any app? BTW I believe skilled Windows developer can't get $100 for half a day in some countries, maybe even full a day.
realusername 6y ago
> There are a lot of people trying really hard to trick users into installing software they don't want. There's big money in it. Authenticode strikes me as an entirely reasonable step to provide more signal to the systems trying to identify and block crapware. Maybe that should be up to the machine owners to decide what to install themselves (crazy idea I know).

colde 6y ago

But why even require payment for these certificates, since Microsoft according to the article doesn't actually place any value on the certificate itself. You still have to build up reputation separately. In that case, it seems entirely unnecessary to require a paid certificate.

repiret 6y ago
Because it costs money to do the identify verification? Its not like a DV certificate where the volume is very high, and the verification isn't hard to automate. I paid $400/yr for my employers first Authenticode certificate back when they were a new thing and you could only get them from Verisign. Now there's a handful of providers and competition has brought the price down, but the volume is lower than DV certs, and verification is harder, so the prices won't go down to zero. Why do identity verification at all, you could ask? A reasonable question; if all I need to start earning reputation is a private key, the costs could go to zero. But letting the scammers make as many identities as they like at no cost changes the prior on a previously unseen identity. It seems MS isn't granting a very strong prior anyway though, so... my argument certainly is weak here.

voltagex_ 6y ago

$100 USD

repiret 6y ago
Yes. I'll accept that thats a lot of money in some places of the world, but thats less than half a day of time for a skilled Windows developer no matter where they live.
- fomine3 6y ago
  So we need to become skilled Windows developer before buy a certificate.
  - repiret 6y ago
    If you're not a skilled windows developer, what use is the certificate?
    - fomine3 6y ago
      Amateur developer shouldn't distribute any app? BTW I believe skilled Windows developer can't get $100 for half a day in some countries, maybe even full a day.

realusername 6y ago

> There are a lot of people trying really hard to trick users into installing software they don't want. There's big money in it. Authenticode strikes me as an entirely reasonable step to provide more signal to the systems trying to identify and block crapware. Maybe that should be up to the machine owners to decide what to install themselves (crazy idea I know).