4 ms·

Ok, tell me then, how does a random person sign their binaries without paying through the nose and going through an extensive review process? It's one thing fo

Ok, tell me then, how does a random person sign their binaries without paying through the nose and going through an extensive review process? It's one thing for a developer to get to distribute apps on an app store full hog with no oversight, and even there app stores are onerous. It's another to stop users from running their own software. Calling that a cultural difference is way too much. Heck, teenage Bill Gates made money selling his own software without someone forbidding it running on their own computers, it'd be hard imagining microsoft being what it is if this is the environment we're leaving the next generation of young hackers.

GoblinSlayer 4y ago
CAs want to eat. Also antivirus doesn't prevent users from running a program, it just shows a scary looking message. The whole thing is just a drop in quality as viruses are a thing of the past since Vista and as a result antiviruses don't have enough funding to maintain quality.
mike_hearn 4y ago
"how does a random person sign their binaries without paying through the nose and going through an extensive review process?" You just self sign. Conveyor does it by default, even. You can always run your own software on your own machine. Now, other people's Windows machines out of the box won't treat that as signed of course. Users would have to install your signing certificate. But you certainly can sign code without paying for it, it's just not meaningful to a fresh Windows install. Self signing is useful for distributing software internal to organizations for example. To distribute more widely, well, neither OV nor EV is actually an extensive review process. Even for EV they just verify that you're actually buying a certificate by looking you up in a business directory and calling you via the published contact details. Nothing about your software is reviewed.

GoblinSlayer 4y ago

CAs want to eat. Also antivirus doesn't prevent users from running a program, it just shows a scary looking message. The whole thing is just a drop in quality as viruses are a thing of the past since Vista and as a result antiviruses don't have enough funding to maintain quality.

mike_hearn 4y ago

"how does a random person sign their binaries without paying through the nose and going through an extensive review process?" You just self sign. Conveyor does it by default, even. You can always run your own software on your own machine. Now, other people's Windows machines out of the box won't treat that as signed of course. Users would have to install your signing certificate. But you certainly can sign code without paying for it, it's just not meaningful to a fresh Windows install. Self signing is useful for distributing software internal to organizations for example. To distribute more widely, well, neither OV nor EV is actually an extensive review process. Even for EV they just verify that you're actually buying a certificate by looking you up in a business directory and calling you via the published contact details. Nothing about your software is reviewed.