3 ms·

It's this sort of attitude that's destroyed the hobbyist programming community for the Windows Platform. It's also an outdated view: 1. Most Windows software

It's this sort of attitude that's destroyed the hobbyist programming community for the Windows Platform. It's also an outdated view: 1. Most Windows software is signed with an Authenticode cert which requires the author to prove who they are to the CA and hand over at least $99. 2. Windows these days has SmartScreen running all the time, which checks executable file hashes against a cloud based database and blocks apps with known issues. Doesn't help if it's an unknown but massively reduces the risk. 3. Windows has a policy that can be enforced that blocks the execution of any software that doesn't pass points #1 and #2.

FoolishTech 5y ago
I'm interested in where you can you get a code certificate for $99? My renewal is coming up and I'm paying $699/annual for a extended validation cert; I'm willing to consider a standard cert but even they are $499/annual. Buying a 3 year cert provides very little discount... that 3 year ev cert on Lockdown and my other apps is a $2000 deal.
- mattowen_uk 5y ago
  Ah it's gone up a bit since I last looked, and you have to hunt around but the base cost seems to be $129: https://www.ssl.com/certificates/code-signing/buy/ https://www.ssl.com/certificates/code-signing/buy/ That's a yearly cost, but you only need to keep renewing if you are signing and releasing new apps or updates. Existing apps you've signed will remain valid if if you don't renew your cert (unlike websites etc.) Also, it seems that the LARGE cost for the EV certs is only really needed for things like Windows drivers.
  - FoolishTech 5y ago
    wow, I hadn't researched in a while, but that looks sketchy. I purchased one that cheap some time around 2011 and the company ended up having certs revoked and went out of business, and the next best thing I found was digicert at a fraction of the cost of the comodo and the like. they do have EV for $350/annual or $750/3 year cert so I might try that it is certainly cheaper than digicert. and yes EV is good for more than drivers, it allows EXEs to bypass smartscreen prompts that would otherwise trigger on standard certs that have to go through reputation checks in smartscreen.
    - mattowen_uk 5y ago
      You make good points - The pricing is still a good example of how it's a tax on hobbyist developers. Is there any 'free' Authenticode cert providers out there? Doing the same job as LetsEncrypt but for code?

FoolishTech 5y ago

I'm interested in where you can you get a code certificate for $99? My renewal is coming up and I'm paying $699/annual for a extended validation cert; I'm willing to consider a standard cert but even they are $499/annual. Buying a 3 year cert provides very little discount... that 3 year ev cert on Lockdown and my other apps is a $2000 deal.

mattowen_uk 5y ago
Ah it's gone up a bit since I last looked, and you have to hunt around but the base cost seems to be $129: https://www.ssl.com/certificates/code-signing/buy/ https://www.ssl.com/certificates/code-signing/buy/ That's a yearly cost, but you only need to keep renewing if you are signing and releasing new apps or updates. Existing apps you've signed will remain valid if if you don't renew your cert (unlike websites etc.) Also, it seems that the LARGE cost for the EV certs is only really needed for things like Windows drivers.
- FoolishTech 5y ago
  wow, I hadn't researched in a while, but that looks sketchy. I purchased one that cheap some time around 2011 and the company ended up having certs revoked and went out of business, and the next best thing I found was digicert at a fraction of the cost of the comodo and the like. they do have EV for $350/annual or $750/3 year cert so I might try that it is certainly cheaper than digicert. and yes EV is good for more than drivers, it allows EXEs to bypass smartscreen prompts that would otherwise trigger on standard certs that have to go through reputation checks in smartscreen.
  - mattowen_uk 5y ago
    You make good points - The pricing is still a good example of how it's a tax on hobbyist developers. Is there any 'free' Authenticode cert providers out there? Doing the same job as LetsEncrypt but for code?