4 ms·

I understand that OS and browser vendors want to protect users from all kinds of exploits, but it's extremely annoying that essentially any new and unknown bina

I understand that OS and browser vendors want to protect users from all kinds of exploits, but it's extremely annoying that essentially any new and unknown binary is treated as if it contained a virus. Windows will show a warning dialog for essentially any unknown executable downloaded from the internet. The only way out of this is to buy a somewhat expensive EV code signing certificate and sign the binary. Or to have that binary become popular enough to get known, but then you have the same issue again after an update. Chrome will tell users that "downloaded files are dangerous" if they are an unknown executable. So far I don't know any way around this warning, and users have to go to the full download page to override this. No idea how to get Chrome to trust this, maybe code signing helps here as well, but who knows. And we're not even at false positives from anti-virus yet, those come on top of these problems.

Dalewyn 4y ago
>Windows will show a warning dialog for essentially any unknown executable downloaded from the internet. Windows has done this since at least XP with any executable of remote origins (including other machines in LANs), regardless of digital signatures. Personally, I think this is fine so long as it is just a notification/warning and lets the user be on their way with a simple confirmation.
mynameisvlad 4y ago
Blame stupid users who open anything and everything without a second thought. The protections are in place because most users can't be trusted to have enough self-control and intelligence to question that attachment called VerifyYourPassword.exe from youronlineaccount@totallyrealchasebank.com
- ta8903 4y ago
  Users opening anything and everything is only a problem because Windows doesn't (or rather didn't, for a long time) have a package manager and "opening anything and everything" is the primary way to install applications.
  - mynameisvlad 4y ago
    Notice how I used an example that’s not remotely related to installing and using application? I highly doubt that having a built in package manager starting in Windows 98 would have in any way shape or form affected how people interact with email attachments. They’re two completely different tasks and nothing about package management would really carry over. People are still going to want to read that super important attachment without a second thought even if they can install a package using Apt. In fact, macOS has pretty much the exact same protections in the form of Gatekeeper, so it’s clearly not a Windows-only thing.
    - account42 4y ago
      > Notice how I used an example that’s not remotely related to installing and using application? GPs point was that users are trained by having to run random executables in order to install anything. That they are now conditioned into casually running other programs that are not installers is the result. > I highly doubt that having a built in package manager starting in Windows 98 would have in any way shape or form affected how people interact with email attachments. They’re two completely different tasks and nothing about package management would really carry over. People are still going to want to read that super important attachment without a second thought even if they can install a package using Apt. This is an argument for making opening something and running something distinct actions in GUI programs (including your mail reader, browser downloads and file explorer) so that a user trying to open something does not execute it by accident, not for the current AV industry. It just so happens that that's how things work in many Linux desktop environments. > In fact, macOS has pretty much the exact same protections in the form of Gatekeeper, so it’s clearly not a Windows-only thing. Apple, like Microsoft, also profits from making developers codesign their applications. They also both want to profit even more by making developers sell their applications through the OS app store where they can take a cut. Both of them engaging in this "security" bs is hardly an argument that they are doing it to protect their users.
- throwaway71271 4y ago
  but thats fine no? how far do you think the current approach is going to go? * lets not allow them to run some program because it is dangerous * maybe just remove all programs that are not signed * actually, only programs that are signed by approved by us devs * not even them, we decide which program should the user install * maybe dont allow them to read email because its dangerous * ... allow them to press only specific keys on the keyboard in case they start entering a credit card, we must read all keys they press * listen to what they say in case they start talking with a dangerous person on the phone we must block the phone call
  - mynameisvlad 4y ago
    This is literally the slippery slope fallacy.
    - account42 4y ago
      Calling something a fallacy does not make it one. Arguing for security without any other considerations has a predictable result: zero freedom.
- saagarjha 4y ago
  Don’t blame users, blame society/technology for not providing adequate context to people do they can make safe decisions.
the_only_law 4y ago
> I understand that OS and browser vendors want to protect users from all kinds of exploits Meanwhile their own products are basically spyware.
mike_hearn 4y ago
There are two types of certificate on Windows: OV and EV. OV is easier to get and the key protection requirements are less strict, but your new identity starts out with no reputation. Browsers will warn you that the program is rarely downloaded until you pick up some reputation from users not reporting it as malware. EV certs don't have that problem. Even for a new company or individual who has never distributed software to Windows before, user won't see any warnings. EV certs have a more thorough ID verification procedure, and keys have to be protected in hardware so you can't accidentally push them somewhere. Most CAs will physically mail you a USB dongle that you can use for signing. Nonetheless, the unknown binary warnings will go away even if you use an OV cert as long as your early users are forgiving.
- nikanj 4y ago
  Our company has had EV-signed binaries flagged as malware by products from Symantec, F-Secure and Avast. Probably others too, those three I can remember off the top of my head.
  - mike_hearn 4y ago
    Yes it's just a signal to AV engines, not a whitelist. Windows Defender is quite respectful of it. Something that can increase the risk of FPs is mixed signing. Like, not signing every DLL and EXE in the program with the same certificate, not signing the installers/packages, only signing the installers/packages and not the contents, etc.

Dalewyn 4y ago

>Windows will show a warning dialog for essentially any unknown executable downloaded from the internet. Windows has done this since at least XP with any executable of remote origins (including other machines in LANs), regardless of digital signatures. Personally, I think this is fine so long as it is just a notification/warning and lets the user be on their way with a simple confirmation.

mynameisvlad 4y ago

Blame stupid users who open anything and everything without a second thought. The protections are in place because most users can't be trusted to have enough self-control and intelligence to question that attachment called VerifyYourPassword.exe from youronlineaccount@totallyrealchasebank.com

ta8903 4y ago
Users opening anything and everything is only a problem because Windows doesn't (or rather didn't, for a long time) have a package manager and "opening anything and everything" is the primary way to install applications.
- mynameisvlad 4y ago
  Notice how I used an example that’s not remotely related to installing and using application? I highly doubt that having a built in package manager starting in Windows 98 would have in any way shape or form affected how people interact with email attachments. They’re two completely different tasks and nothing about package management would really carry over. People are still going to want to read that super important attachment without a second thought even if they can install a package using Apt. In fact, macOS has pretty much the exact same protections in the form of Gatekeeper, so it’s clearly not a Windows-only thing.
  - account42 4y ago
    > Notice how I used an example that’s not remotely related to installing and using application? GPs point was that users are trained by having to run random executables in order to install anything. That they are now conditioned into casually running other programs that are not installers is the result. > I highly doubt that having a built in package manager starting in Windows 98 would have in any way shape or form affected how people interact with email attachments. They’re two completely different tasks and nothing about package management would really carry over. People are still going to want to read that super important attachment without a second thought even if they can install a package using Apt. This is an argument for making opening something and running something distinct actions in GUI programs (including your mail reader, browser downloads and file explorer) so that a user trying to open something does not execute it by accident, not for the current AV industry. It just so happens that that's how things work in many Linux desktop environments. > In fact, macOS has pretty much the exact same protections in the form of Gatekeeper, so it’s clearly not a Windows-only thing. Apple, like Microsoft, also profits from making developers codesign their applications. They also both want to profit even more by making developers sell their applications through the OS app store where they can take a cut. Both of them engaging in this "security" bs is hardly an argument that they are doing it to protect their users.
throwaway71271 4y ago
but thats fine no? how far do you think the current approach is going to go? * lets not allow them to run some program because it is dangerous * maybe just remove all programs that are not signed * actually, only programs that are signed by approved by us devs * not even them, we decide which program should the user install * maybe dont allow them to read email because its dangerous * ... allow them to press only specific keys on the keyboard in case they start entering a credit card, we must read all keys they press * listen to what they say in case they start talking with a dangerous person on the phone we must block the phone call
- mynameisvlad 4y ago
  This is literally the slippery slope fallacy.
  - account42 4y ago
    Calling something a fallacy does not make it one. Arguing for security without any other considerations has a predictable result: zero freedom.
saagarjha 4y ago
Don’t blame users, blame society/technology for not providing adequate context to people do they can make safe decisions.

the_only_law 4y ago

> I understand that OS and browser vendors want to protect users from all kinds of exploits Meanwhile their own products are basically spyware.

mike_hearn 4y ago

There are two types of certificate on Windows: OV and EV. OV is easier to get and the key protection requirements are less strict, but your new identity starts out with no reputation. Browsers will warn you that the program is rarely downloaded until you pick up some reputation from users not reporting it as malware. EV certs don't have that problem. Even for a new company or individual who has never distributed software to Windows before, user won't see any warnings. EV certs have a more thorough ID verification procedure, and keys have to be protected in hardware so you can't accidentally push them somewhere. Most CAs will physically mail you a USB dongle that you can use for signing. Nonetheless, the unknown binary warnings will go away even if you use an OV cert as long as your early users are forgiving.

nikanj 4y ago
Our company has had EV-signed binaries flagged as malware by products from Symantec, F-Secure and Avast. Probably others too, those three I can remember off the top of my head.
- mike_hearn 4y ago
  Yes it's just a signal to AV engines, not a whitelist. Windows Defender is quite respectful of it. Something that can increase the risk of FPs is mixed signing. Like, not signing every DLL and EXE in the program with the same certificate, not signing the installers/packages, only signing the installers/packages and not the contents, etc.