5 ms·

If you think Apple sucks look at signing binaries on Windows. If you don‘t use the Microsoft App Store it‘s much more expensive and annoying. It basically requ

by lwkl 4y ago

If you think Apple sucks look at signing binaries on Windows. If you don‘t use the Microsoft App Store it‘s much more expensive and annoying. It basically requires you to be incorporated and hire a notary so you‘re probably spending $ 1000 or more for the first year. Renewal is cheaper but you will still be paying at least $ 100 a year. Also if you know a good affordable way for a code signing certificate on Windows answer to this comment. I gave up the last time I tried.

dave78 4y ago
I've been using: https://www.ksoftware.net/code-signing-certificates/ https://www.ksoftware.net/code-signing-certificates/ Last time I looked they had the best pricing I could find at about $70/year. However, you still have to jump through the antiquated hoops for them to validate your business. One of the hoops was something like "have a business address and phone number listed in a commercial directory" which was particularly tricky to do for us since we don't have a company office anywhere and don't have a company phone number. In 2022, it should be reasonable for a software company to exist without a published phone number. I think we got around that by setting up a Twilio or Google Voice number and then adding a business listing in Google to one of our owner's residential addresses. Totally useless but apparently good enough to pass validation.
oleks637 4y ago
You can get an OV code signing certificate for 84$ per year - https://www.ksoftware.net/code-signing-certificates/ https://www.ksoftware.net/code-signing-certificates/ I'm using it for my app, and I never had any issues. You don't need to incorporate a company to get this certificate ( https://support.sectigo.com/PS_KnowledgeDetailPageFaq?Id=kA01N000000brb0 https://support.sectigo.com/PS_KnowledgeDetailPageFaq?Id=kA0... scroll down to the Individual Validation Requirements). If your ID has your address printed on it, then you are lucky and can just take a photo of the ID and yourself holding the ID. If you don't, then you need to go to a notary and sign a special form provided by Sectigo. Sectigo doesn't even need to call you anymore, as it was about 5-10 years ago. The downside of the OV certificate is that Windows Defender will show a blue pop-up saying that your app might put the user's PC at risk. Good thing is that it will eventually go away after some time. For my app it took about a year.
- dvzk 4y ago
  Maybe it’s just me, but I would never go through a random certificate authority like “K Software”. Users are not cryptographically verifying the developer’s signing identity, they are trusting KSoftware’s attestation that the signed binary is authentic.
- lwkl 4y ago
  > If your ID has your address printed on it, then you are lucky and can just take a photo of the ID and yourself holding the ID. If you don't, then you need to go to a notary and sign a special form provided by Sectigo. That's the problem ID's don't have addresses printed on them in most European countries. So you have to get a notary and this is really expensive. There is a system to proof your place of residence here without a notary but these companies don't accept them.
superkuh 4y ago
Uh.... what? Unless something drastically changed in the last couple weeks Windows does not go out of it's way to prevent you from running executables unless they are cryptographically signed by Windows. There's no reason to do windows code signing unless you're writing a hardware driver(?).
- mike_hearn 4y ago
  Try downloading and running an unsigned exe using Edge. I'm not a fan of the term "dark pattern" as it gets overused, but the UI design in those flows is pretty much the definition of the term. You can bypass the warnings and run the program but it makes Apple's magic right click look intuitive.
- newaccount74 4y ago
  Windows has this thing where "unpopular" software gets blocked by default. I'm not sure how exactly it works, but it's annoying.

by lwkl 4y ago

dave78 4y ago

I've been using: https://www.ksoftware.net/code-signing-certificates/ https://www.ksoftware.net/code-signing-certificates/ Last time I looked they had the best pricing I could find at about $70/year. However, you still have to jump through the antiquated hoops for them to validate your business. One of the hoops was something like "have a business address and phone number listed in a commercial directory" which was particularly tricky to do for us since we don't have a company office anywhere and don't have a company phone number. In 2022, it should be reasonable for a software company to exist without a published phone number. I think we got around that by setting up a Twilio or Google Voice number and then adding a business listing in Google to one of our owner's residential addresses. Totally useless but apparently good enough to pass validation.

oleks637 4y ago

You can get an OV code signing certificate for 84$ per year - https://www.ksoftware.net/code-signing-certificates/ https://www.ksoftware.net/code-signing-certificates/ I'm using it for my app, and I never had any issues. You don't need to incorporate a company to get this certificate ( https://support.sectigo.com/PS_KnowledgeDetailPageFaq?Id=kA01N000000brb0 https://support.sectigo.com/PS_KnowledgeDetailPageFaq?Id=kA0... scroll down to the Individual Validation Requirements). If your ID has your address printed on it, then you are lucky and can just take a photo of the ID and yourself holding the ID. If you don't, then you need to go to a notary and sign a special form provided by Sectigo. Sectigo doesn't even need to call you anymore, as it was about 5-10 years ago. The downside of the OV certificate is that Windows Defender will show a blue pop-up saying that your app might put the user's PC at risk. Good thing is that it will eventually go away after some time. For my app it took about a year.

dvzk 4y ago
Maybe it’s just me, but I would never go through a random certificate authority like “K Software”. Users are not cryptographically verifying the developer’s signing identity, they are trusting KSoftware’s attestation that the signed binary is authentic.
lwkl 4y ago
> If your ID has your address printed on it, then you are lucky and can just take a photo of the ID and yourself holding the ID. If you don't, then you need to go to a notary and sign a special form provided by Sectigo. That's the problem ID's don't have addresses printed on them in most European countries. So you have to get a notary and this is really expensive. There is a system to proof your place of residence here without a notary but these companies don't accept them.

superkuh 4y ago

Uh.... what? Unless something drastically changed in the last couple weeks Windows does not go out of it's way to prevent you from running executables unless they are cryptographically signed by Windows. There's no reason to do windows code signing unless you're writing a hardware driver(?).

mike_hearn 4y ago
Try downloading and running an unsigned exe using Edge. I'm not a fan of the term "dark pattern" as it gets overused, but the UI design in those flows is pretty much the definition of the term. You can bypass the warnings and run the program but it makes Apple's magic right click look intuitive.
newaccount74 4y ago
Windows has this thing where "unpopular" software gets blocked by default. I'm not sure how exactly it works, but it's annoying.