3 ms·

For open source apps: Perhaps have a build service (Azure+github) that builds the software from source, then automatically signs it. Perhaps have some kind of a

For open source apps: Perhaps have a build service (Azure+github) that builds the software from source, then automatically signs it. Perhaps have some kind of application + manual review + requirements (like Github 2FA) process. Scanning for malicious source code would help a small bit as well. For individuals: Some countries have an electronic identity system (eID), that would allow verification of name + address when code signing while being as secure/more secure than the usb sticks one gets for an EV certificate + the EV address/identity verification process. Because there is no standard this would be a lot of per-country work. And some countries don't have a (good) eID system (or an ID system at all). I only know the technical details of the German one and that one would work. For businesses: EV certificates shouldn't be too much of a cost there. Though I am annoyed by the lack of competition driving the prices down in this area. Maybe make it easier for new authorities to enter the market?

mjevans 6y ago
To start with, the shared libraries (DLLs SOs, whatever) should be something MS makes easy for their authors to get inside of an official package distribution channel. For Windows that happens to be the 'Microsoft Store' and they should be free (as in beer). That would then let MS worry about only the business logic and other glue using that already trustworthy or at least trust-rated code. That too, if it's free of charge software, should have ways of being published that make it easier to verify something is safe, and if it's questionable, then engage in more of a process.