4 ms·

Microsoft are already inferring that arbitrary software is dangerous - SmartScreen's behaviour for unsigned code works against FOSS because a project (or person

Microsoft are already inferring that arbitrary software is dangerous - SmartScreen's behaviour for unsigned code works against FOSS because a project (or person) has to pony up money to pay for a certificate.

dylan604 5y ago
maybe this is something that can be part of a give/take relationship. allow for FOSS to be part of the signing/notrization software as long as the FOSS is truly not-for-profit (no free software for install, but doesn't work without lots of in-app purchases, ads, etc). At least offer FOSS software devs a lower cost entry for dev accounts??
- WhyNotHugo 5y ago
  FOSS doesn’t imply no-for-profit. You can use my code however you like, but I still need money to pay rent.
  - dylan604 5y ago
    Right, so you gets to pay the dev fees to have your code signed. That's why I specifically stated not-for-profit could use "free" code signing. If you're making money off of the software, pay the fees required as part of the business.
    - WhyNotHugo 5y ago
      This “fee” is just a vendor abusing their position of power, If you pay me to write code, and you want to run it on your PC, there’s no reason we should be having to pay a third party to allow this.
- badsectoracula 5y ago
  Even though most users aren't developers, the "Freedom" in Free Software is about user freedom not developer freedom (which is also a point that trips some developers who claim that licenses like MIT, zlib, etc are more free - they see it from the developer's side instead of the user's side). You shouldn't need permission from a 3rd party to run any software on your own devices and especially you shouldn't need permission from a 3rd party to run software you or your friend made modifications to.
  - dylan604 5y ago
    Yes, but it's Apple we're talking about, so I'm moving past this part of the conversation. As a dev, you should want the least resistance to getting users running your code. If that means playing by the OS vendor's rules to get something signed that says "I'm not a crook", then that's what it takes. Should it? That's valid but beyond the scope of my comment and thought exercise.
    - JohnFen 5y ago
      As a dev, I also want to avoid supporting practices that I believe are harmful to my customers.
      - dylan604 5y ago
        I applaud your stance. So now it comes down to knowing what your software is intended to do, and who is trying to use it. If your target audience doesn't line up with your stance on an open OS, then you have to make that decision of staying true to your position, or meeting your users where they operate. As they say "a leader with no followers is just a person taking a walk".
LocalH 5y ago
Google Chrome does too, as anyone who has ever seen the "This file is not commonly downloaded and may be dangerous" message can attest.
- account42 5y ago
  Both Microsoft and Google will outright claim that files are Malware and even make up names for some trojan or whatever that the file supposedly contains based on nothing more than machine learning algorithms an heuristics. They will then drag their feet in removing the false positives, deny the review without any reason or simply automatically flag the same file again and again and again. All while Microsoft and Google are not letting users download the files without navigating through intentionally misnamed menu options or just straight up delete the legitimate software without any user promt. At this point I can only assume that this behavior is has malicious intent.

dylan604 5y ago

maybe this is something that can be part of a give/take relationship. allow for FOSS to be part of the signing/notrization software as long as the FOSS is truly not-for-profit (no free software for install, but doesn't work without lots of in-app purchases, ads, etc). At least offer FOSS software devs a lower cost entry for dev accounts??

WhyNotHugo 5y ago
FOSS doesn’t imply no-for-profit. You can use my code however you like, but I still need money to pay rent.
- dylan604 5y ago
  Right, so you gets to pay the dev fees to have your code signed. That's why I specifically stated not-for-profit could use "free" code signing. If you're making money off of the software, pay the fees required as part of the business.
  - WhyNotHugo 5y ago
    This “fee” is just a vendor abusing their position of power, If you pay me to write code, and you want to run it on your PC, there’s no reason we should be having to pay a third party to allow this.
badsectoracula 5y ago
Even though most users aren't developers, the "Freedom" in Free Software is about user freedom not developer freedom (which is also a point that trips some developers who claim that licenses like MIT, zlib, etc are more free - they see it from the developer's side instead of the user's side). You shouldn't need permission from a 3rd party to run any software on your own devices and especially you shouldn't need permission from a 3rd party to run software you or your friend made modifications to.
- dylan604 5y ago
  Yes, but it's Apple we're talking about, so I'm moving past this part of the conversation. As a dev, you should want the least resistance to getting users running your code. If that means playing by the OS vendor's rules to get something signed that says "I'm not a crook", then that's what it takes. Should it? That's valid but beyond the scope of my comment and thought exercise.
  - JohnFen 5y ago
    As a dev, I also want to avoid supporting practices that I believe are harmful to my customers.
    - dylan604 5y ago
      I applaud your stance. So now it comes down to knowing what your software is intended to do, and who is trying to use it. If your target audience doesn't line up with your stance on an open OS, then you have to make that decision of staying true to your position, or meeting your users where they operate. As they say "a leader with no followers is just a person taking a walk".

LocalH 5y ago

Google Chrome does too, as anyone who has ever seen the "This file is not commonly downloaded and may be dangerous" message can attest.

account42 5y ago
Both Microsoft and Google will outright claim that files are Malware and even make up names for some trojan or whatever that the file supposedly contains based on nothing more than machine learning algorithms an heuristics. They will then drag their feet in removing the false positives, deny the review without any reason or simply automatically flag the same file again and again and again. All while Microsoft and Google are not letting users download the files without navigating through intentionally misnamed menu options or just straight up delete the legitimate software without any user promt. At this point I can only assume that this behavior is has malicious intent.