6 ms·
Well, the "Smart" screen says that WinMerge and KDiff3 are malwares. Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen,
by e3bc54b2 5y ago
Well, the "Smart" screen says that WinMerge and KDiff3 are malwares.
Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen, I can inspect their code. Yes, the binaries can contain malware, but the first principles tell me that trustability score is inverse of what is being reported by MS.
Naturally I have disabled Smartscreen and Windows defender and admin rights alerts and bajilion things that internet gurus will tell me not to because I don't know what's good for me. Needless to say, my PC runs faster, calmer and is actually malware free because I don't run unauditable things like Smartscreen on it.
Edit: I get WinMerge binary from GitHub repo, and KDiff3 from official website. As trusted as it can get, short of compiling myself.
This is a work machine so I can't control most of Windows behavior. Personal machine runs NixOS for 90% tasks + Windows dual boot for games without connecting to network because I can't be bothered with disabling Smartscreen and defender every other week.
- cptskippy 5y ago> Well, the "Smart" screen says that WinMerge and KDiff3 are malwares. I've got WinMerge installed on my machines and I've never had that issue. Are you sure you're using trusted sources?
- e3bc54b2 5y agoI got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself.
- lghh 5y ago> Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen, I can inspect their code. > I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself. So, you don't actually know what code you're running and that binary actually could be malware.
- e3bc54b2 5y agoYes, and original comment addresses that. In theory WinMerge binary can contain malware. But WinMerge authors have a proven track record against that and they are transparent about working of their application enough through their source. MS and Smartscreen do not have that track record, and IMO have an opposite kind of record with all kind of map/adware practices throughout the system and applications. So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more?
- cptskippy 5y ago> So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more? I honestly don't understand how you've made this an adversarial situation. It's almost as if you take offense to Smartscreen telling you it doesn't trust your binary. The system is pretty straight forward, Smartscreen checks the file source against a list of known bad actors. If there's a hit it's saying "I can't vouch for this". I checked and WinMerge isn't flagged in Smartscreen. The publisher however does not use a signing certificate which results in a UAC prompt. In any case neither of these features prevent installation, they're just warnings you can circumvent.
- fomine3 5y agoIf you don't trust SmartScreen, you'll also don't trust Windows, so using Windows is the problem rather than SmartScreen.
- TimTheTinker 5y agoIt sounds like you, sir or madam, need to get rid of Windows entirely. May I suggest macOS (and Parallels running Ubuntu Linux if you like WSL)?
- hnlmorg 5y agomacOS isn't any better in that regard. Some software takes 30+ seconds of Apple "verifying" before the application is even launched.
- imwillofficial 5y agoBesides the recent outage snafu, when does this happen? I haven’t seen it.
- duskwuff 5y agoThis usually comes up as a problem when you try running a large application from a compressed disk image. Copy the application out of the disk image first. Verifying the application (and running it) will be much faster.
- hnlmorg 5y agoHonestly, I'd rather disable that feature entirely. It adds zero value for engineers like us.
- e3bc54b2 5y agoThis is a work machine. My personal laptop runs NixOS.
- specialp 5y agoThat is fine but probably not good for most users. It is easy to tell it not to filter those apps. You can make exceptions. Just shutting it off totally is like changing a router to allow all ports and traffic in because it blocked a port you were using vs making a firewall rule. Like I found that SmartScreen and defender blocked my ethminer but that is in general pretty smart because it is common to have it unwittingly installed, and I simply said it is OK to run.
- nightski 5y agoI use both of these and have never received a malware indication. Sounds fishy.
- JacobiX 5y agoFor WinMerge it should be noted that some web-sites out-there offer winmerge binaries for download and I bet that some of them are bundled with spyware (they are not affiliated with the official version, but even my tech-savvy friend was about to download winmerge the other day from a non official source, I noticed him that he should use winmerge.org).
- e3bc54b2 5y agoI get the binaries from GitHub repo directly.
- shawnz 5y agoSmartscreen does not tell you that WinMerge is malware. It correctly tells you that the freshly compiled build from GitHub is not a commonly used software which makes it more likely to be dangerous. How is that a bad feature to have?
- e3bc54b2 5y agoHow is that a good feature? Just because something is not commonly used it stops being good? When most software was proprietary and FLOSS was nascent, MS argued that FLOSS was bad, was that right? Conversely, just because something is used more, does that get the automatic stamp of approval? More than 2 Billion people use Facebook every month, do you consider FB to be more likely to be good for someone? What kind of messed up logic is that?
- shawnz 5y agoNo. Smartscreen is not meant to single-handedly solve the entire problem of malware. It is just meant to warn you when you are running software that isn't commonly used. It is nothing more than an attempt to provide the user with a useful heuristic. It does not make moral judgements about the software you use like you are saying here.
- jcelerier 5y agoBut this is empirically not a good heuristic ?
- kuratkull 5y agoIt usually makes you have a quick rundown about what you are trying to run. If it's some software I got from the projects original GitHub page I make a note of that and proceed. If it's something that should surely not be "rarely used" (eg. A browser,video player,torrent client, etc) I think twice.
- delusional 5y agoOnly warning people when it isn't common used is a judgment. Why is software that isn't commonly used a danger? Where do you set the limit? Is infrequently used software signed by Microsoft dangerous? Showing a warning about anything is not value neutral. Showing a popup for infrequently used software says that you value number of users as a measure of software quality.
- imwillofficial 5y ago“ I don't run unauditable things like Smartscreen on it.” You mean, like Windows?