4 ms·

Does anyone know how this software passed Microsoft smartscreen and typical antivirus apps? As someone distributing legitimate software on Windows, I feel like

by klabb3 4y ago

Does anyone know how this software passed Microsoft smartscreen and typical antivirus apps? As someone distributing legitimate software on Windows, I feel like I was heavily scrutinized and getting code signing certs was a real pain, and costly. What's the purpose if it can't even weed out crap like this?

ranger_danger 4y ago
Smartscreen has always been a joke.
- game-of-throws 4y ago
  I hoped with Lets Encrypt we were past the days of paying for cryptographic signatures, but Microsoft is keeping the legacy alive
  - ranger_danger 4y ago
    AFAIK Lets Encrypt does not provide free code-signing certificates, but I did hear of a group that was trying to do that. Can't recall the name right now.
    - buzer 4y ago
      This one maybe? https://www.sigstore.dev/ https://www.sigstore.dev/ > What's the current status? > We’re working hard to release v1.0 in July. Hopefully they are close to release.
  - donmcronald 4y ago
    It's an absolute sham and Microsoft is using their market dominance to give us a worse product for more money. I would love to see someone start a Windows app store that's based on domain validated code signing. Domains are better trust indicators than business names IMO.
chatmasta 4y ago
They probably just tell the user to bypass the prompts. For example, my college roommate went to great lengths to install what he thought was a Pokémon blue emulator on his laptop. All the security checks in the world won’t protect a user determined to silence them. I don’t know that’s what happened here, but it sounds like some of the installs were PPI, so I wouldn’t be surprised. That basically means anyone who can figure out how to bundle the software with an artifact can distribute it. A long time ago, and probably today too, people used to crack popular programs, bundle some adware into them, and then seed the torrent. The user is already committed to circumventing security checks and entering strange commands, so I can imagine how they might end up installing some bonus executables in the process.
- userbinator 4y ago
  All the security checks in the world won’t protect a user determined to silence them. And that is IMHO a good thing. The alternative is a world where no one has any freedom.
  - morbia 4y ago
    Just to play devil's advocate, what about situations where someone's freedom to use software encroaches on others? For example, what if a user uses those freedoms to install malware that adds their machine to a botnet?
    - BenjiWiebe 4y ago
      Same as freedom to put poison in your own food vs poison in someone else's food. They're different things.
    - userbinator 4y ago
      Everything you do in this world "enroaches on others" to some extent. One of the core tenets of freedom, at least in the West, is that we need to allow a certain amount of that and consider the fact that people will not always do what you want as a necessary condition for freedom to exist.

by klabb3 4y ago

ranger_danger 4y ago

Smartscreen has always been a joke.

game-of-throws 4y ago
I hoped with Lets Encrypt we were past the days of paying for cryptographic signatures, but Microsoft is keeping the legacy alive
- ranger_danger 4y ago
  AFAIK Lets Encrypt does not provide free code-signing certificates, but I did hear of a group that was trying to do that. Can't recall the name right now.
  - buzer 4y ago
    This one maybe? https://www.sigstore.dev/ https://www.sigstore.dev/ > What's the current status? > We’re working hard to release v1.0 in July. Hopefully they are close to release.
- donmcronald 4y ago
  It's an absolute sham and Microsoft is using their market dominance to give us a worse product for more money. I would love to see someone start a Windows app store that's based on domain validated code signing. Domains are better trust indicators than business names IMO.

chatmasta 4y ago

They probably just tell the user to bypass the prompts. For example, my college roommate went to great lengths to install what he thought was a Pokémon blue emulator on his laptop. All the security checks in the world won’t protect a user determined to silence them. I don’t know that’s what happened here, but it sounds like some of the installs were PPI, so I wouldn’t be surprised. That basically means anyone who can figure out how to bundle the software with an artifact can distribute it. A long time ago, and probably today too, people used to crack popular programs, bundle some adware into them, and then seed the torrent. The user is already committed to circumventing security checks and entering strange commands, so I can imagine how they might end up installing some bonus executables in the process.

userbinator 4y ago
All the security checks in the world won’t protect a user determined to silence them. And that is IMHO a good thing. The alternative is a world where no one has any freedom.
- morbia 4y ago
  Just to play devil's advocate, what about situations where someone's freedom to use software encroaches on others? For example, what if a user uses those freedoms to install malware that adds their machine to a botnet?
  - BenjiWiebe 4y ago
    Same as freedom to put poison in your own food vs poison in someone else's food. They're different things.
  - userbinator 4y ago
    Everything you do in this world "enroaches on others" to some extent. One of the core tenets of freedom, at least in the West, is that we need to allow a certain amount of that and consider the fact that people will not always do what you want as a necessary condition for freedom to exist.