3 ms·

Apple’s tools really could emit better messages when things go wrong. It’s sad that they hit a dead-end with this after everything they went through. Windows i

Apple’s tools really could emit better messages when things go wrong. It’s sad that they hit a dead-end with this after everything they went through. Windows isn’t a cakewalk either (you now have to use a hardware security module to store your certs, which means USB stick based signing or using a cloud service that supports HSMs, plus certs themselves are a racket in terms of pricing).

pansa2 3y ago
But Windows is still happy to run downloaded executables that aren’t signed, isn’t it? OTOH it sounds like macOS requires everything to be signed.
- viraptor 3y ago
  No, you have to do a bit of work to proceed with the installation. Windows with throw some scary warnings at you if you download something unsigned and try to run it. And if you're very unlucky and anger the SmartScreen, you may need to use power user level workarounds.
- modernerd 3y ago
  No, Windows 11 presents two scary-looking popups for unsigned apps: - “Windows protected your PC” with some tiny blurb no-one seems to read and a single button labelled “Don’t run”. - If you do read the tiny blurb and spot the “More info” link, you can click it to get a summary about Windows Defender SmartScreen having saved the day by protecting you from this app by an “unknown publisher”, and then a second button becomes available that says, “Run anyway”. It’s pretty hostile and it effectively forces devs to throw 300-600usd/year at a cert provider plus spend time to configure signing via CI. There are also two levels of certificate, and the better one is only available if you’ve been in business for several years with an office address and public phone number (cert providers need to call you at your public number to validate your business ID). There are some ways around it (I think games distributed via Steam’s installer still don’t need to be signed) but those aren’t an option for many.
  - pansa2 3y ago
    Thanks. Is that behaviour new to Windows 11? I’ve never seen it on Windows 10.
    - modernerd 3y ago
      I think Win 10 had SmartScreen too, but haven’t tested unsigned apps there yet.
    - evanelias 3y ago
      Same behavior on Windows 10. Been like this for years. Distributing a command-line tool for Windows is a complete nightmare in my experience, far more frustrating than on a Mac.

pansa2 3y ago

But Windows is still happy to run downloaded executables that aren’t signed, isn’t it? OTOH it sounds like macOS requires everything to be signed.

viraptor 3y ago
No, you have to do a bit of work to proceed with the installation. Windows with throw some scary warnings at you if you download something unsigned and try to run it. And if you're very unlucky and anger the SmartScreen, you may need to use power user level workarounds.
modernerd 3y ago
No, Windows 11 presents two scary-looking popups for unsigned apps: - “Windows protected your PC” with some tiny blurb no-one seems to read and a single button labelled “Don’t run”. - If you do read the tiny blurb and spot the “More info” link, you can click it to get a summary about Windows Defender SmartScreen having saved the day by protecting you from this app by an “unknown publisher”, and then a second button becomes available that says, “Run anyway”. It’s pretty hostile and it effectively forces devs to throw 300-600usd/year at a cert provider plus spend time to configure signing via CI. There are also two levels of certificate, and the better one is only available if you’ve been in business for several years with an office address and public phone number (cert providers need to call you at your public number to validate your business ID). There are some ways around it (I think games distributed via Steam’s installer still don’t need to be signed) but those aren’t an option for many.
- pansa2 3y ago
  Thanks. Is that behaviour new to Windows 11? I’ve never seen it on Windows 10.
  - modernerd 3y ago
    I think Win 10 had SmartScreen too, but haven’t tested unsigned apps there yet.
  - evanelias 3y ago
    Same behavior on Windows 10. Been like this for years. Distributing a command-line tool for Windows is a complete nightmare in my experience, far more frustrating than on a Mac.