5 ms·

While you are not too far into selling - a word of advice. Switch to offering a year of free updates and charge a small fee after that. Trust me. You will cov

by eps 2y ago

While you are not too far into selling - a word of advice. Switch to offering a year of free updates and charge a small fee after that. Trust me. You will coverge to this scheme sooner or later, so do it now. - Standalone Windows installer is a must. Windows Store is still a deserted wasteland and is not a default choice for the vast majority of Windows users. You are losing a ton of users over this. - ffmpeg and other dependencies need to be acknowledged for both ethical and technical reasons. The technical reason is that your app doesn't depend on OS-supplied codecs and doesn't require installing them separately. And ethical reasons I hope are obvious.

rubymamis 2y ago
The problem with distributing standalone installers on Windows is that all non-popular apps are immediately regarded as malware by Windows Defender unless you go through the horrendous process of signing your app, which requires obtaining a certificate (which also requires forming a company that is not an LLC) and waiting more than a month while navigating multiple rounds of bureaucracy. I’ve done it for my app, and it was a terrible experience. Microsoft should study how Apple handles signing and notarization. EDIT: spelling.
- kryptocannon 2y ago
  > which also requires forming a company that is not an LLC I always thought that an LLC was sufficient, what's the actual requirement if an LLC is not enough?
  - wongarsu 2y ago
    We got a certificate with a company that's the local equivalent of an LLC, and have seen certificates issued to private individuals. As far as I can tell it's up to the issuer who they support in their verification process. Many of them are pretty inflexible with somewhat arcane processes designed decades ago (with ancient websites portals to match), so your experience may vary An additional detail is that there are two levels of code signing certificates, normal and EV (extended validation) certificate. EV certificates make windows completely drop the low-reputation screen and causes many antivirus solutions to trust you but are expensive and are a bit of a pain to get. Normal certificates are cheaper and comparatively easier to acquire, but only give partial benefits (less scary screen from Windows, some leeway from antivirus).
  - rubymamis 2y ago
    Like wongarsu described, there are two types of certificates. I got the more trusted one (EV certificate) which has higher requirement standards (one of which is to be a formed corporation that is not a sole proprietorship).
  - Nzen 2y ago
    For an EV certificate, you need to have a government-registered business [0], though a record of Doing Business As should be sufficient. Where I live, that involves filling a form, paying a fee, and taking out a classified add for 3 weeks [1]. There are cheaper certificates, OV, that merely require a notary public's confirmation (which is what I did). However, as the other post said, Windows will treat an EV certificate with very high trust and should not show SmartScreen. For OV signed software, it looks like [3] Microsoft will use some telemetry to assemble a trust score as people download and accept the risk of running the software, over days or weeks. [0] https://support.ksoftware.net/support/solutions/articles/35844-what-are-the-requirements-to-obtain-an-ov-or-ev-code-signing-certificate- https://support.ksoftware.net/support/solutions/articles/358... KSoftware is a sales partner for Sectigo. I used their service and later Sectigo directly, before last year's change to require FIPS hardware for managing the code signing certificate. [1] https://www.cookcountyclerkil.gov/vital-records/business-notary/assumed-business-name-registration https://www.cookcountyclerkil.gov/vital-records/business-not... [2] https://support.ksoftware.net/support/solutions/articles/232500-what-are-the-differences-between-ov-and-ev-level-code-signing-certificates- https://support.ksoftware.net/support/solutions/articles/232... [3] https://stackoverflow.com/a/65653792/504994 https://stackoverflow.com/a/65653792/504994
- 9cb14c1ec0 2y ago
  Azure trusted signing for the win. Only $9.99/month.
  - _mlbt 2y ago
    That is still more expensive than the $99 a year Apple charges, and you get al lot more than just signing for that price.
  - rubymamis 2y ago
    Never heard of this! What kind of certificate does it support (oddly enough, it doesn't say on the website). Do you have experience with the process?
    - 9cb14c1ec0 2y ago
      Code signing cert. It works best as part of Github actions.
  - JanisErdmanis 2y ago
    Can Azure sign MSIX application bundles with that subscription price?
- huhtenberg 2y ago
  > signing your app, which requires obtaining a certificate (which also requires forming a company that is not an LLC) and waiting more than a month while navigating multiple rounds of bureaucracy. This is not true, not as phrased. A. You can get a cert issued in your personal name. Not an EV one, but still. B. You are likely to already have a company if you are selling online. C. It doesn't take "a month" even for an EV cert. Several days tops unless you go through Comodo, in which case you get what you pay for. D. It is perfectly fine to distribute unsigned installers. They produce a warning on launch, granted, but contrary to the urban legend they are not getting instantly shit-canned by the Defender.
  - rubymamis 2y ago
    A. Indeed, that requirement only apply to EV cert (at least for the cert authority I used). B. That's not always the case with indie developers. C. Well, it took me. My cert authority was GlobalSign. > but contrary to the urban legend they are not getting instantly shit-canned by the Defender. That was not my experience. Try to download an unsigned binary using Edge and see what happens. From what I remember (I'm on macOS, mostly), they are "getting instantly shit-canned".
    - lazyeye 2y ago
      There is a new approach to doing code-signing called "trusted signing". Havent used it myself so can't comment on the benefits https://www.advancedinstaller.com/trusted-signing-integration.html https://www.advancedinstaller.com/trusted-signing-integratio... https://learn.microsoft.com/en-us/azure/trusted-signing/overview https://learn.microsoft.com/en-us/azure/trusted-signing/over...
  - mike_hearn 2y ago
    They don't produce a warning on launch, but browsers will make it hard to open unsigned installers. Edge makes it especially hard. Chrome less so.
  - mceachen 2y ago
    Who was your EV cert vendor? I've recently used two different vendors, replied within minutes to each of their queries in hopes of expediting the process, but each time it took the better part of 2 months before I was in possession of a USB signing key. This is for a Delaware C-corp, so it was about as vanilla as it could be for their side.
- bagels 2y ago
  Just went through the code signing odyssey. It is a racket, but it did not take me a month. It took me a week and a half, including integration in to automated builds.
  - crummy 2y ago
    How do the automated builds work? When I tried this five years ago a hardware dongle needed to be connected to the build machine.
    - bagels 2y ago
      Yes, there is a self hosted GitHub runner for signing. The token is installed on a desktop in the office that runs this.
pletnes 2y ago
As far as I understand, windows store is no longer available on enterprise windows. So if you want to sell a business app, it is not even an option.
- MetaWhirledPeas 2y ago
  It's still there on the version of Windows 11 I use at my office.
  - pletnes 2y ago
    It’s gone on win10 at my office. With a «closed permanently» message.
  - ItsBob 2y ago
    It doesn't come as standard on Enterprise 11. Source: I just installed Enterprise 11 on my desktop a week ago and I had to manually install Microsoft Store manually.
spacechild1 2y ago
> Standalone Windows installer is a must. 100% agree! I've been using Windows for over 20 years and I haven't installed a single app through Windows Store.
thr0waway001 2y ago
Can you elaborate on the ethical reasons? I should mention that I'm not very smart.
- swyx 2y ago
  he is standing on shoulders of giants, itd be nice if they just got a simple thank you.
- me-vs-cat 2y ago
  FFmpeg's license has various requirements, including: "Give prominent notice with each copy of the Combined Work that the Library is used in it and that the Library and its use are covered by this License."
  - thr0waway001 2y ago
    Ok, I guess I had guessed correctly. Though I was curious if I had missed something.
firemelt 2y ago
can u elaborate more? why 1 year and small fee after?

by eps 2y ago

rubymamis 2y ago

The problem with distributing standalone installers on Windows is that all non-popular apps are immediately regarded as malware by Windows Defender unless you go through the horrendous process of signing your app, which requires obtaining a certificate (which also requires forming a company that is not an LLC) and waiting more than a month while navigating multiple rounds of bureaucracy. I’ve done it for my app, and it was a terrible experience. Microsoft should study how Apple handles signing and notarization. EDIT: spelling.

kryptocannon 2y ago
> which also requires forming a company that is not an LLC I always thought that an LLC was sufficient, what's the actual requirement if an LLC is not enough?
- wongarsu 2y ago
  We got a certificate with a company that's the local equivalent of an LLC, and have seen certificates issued to private individuals. As far as I can tell it's up to the issuer who they support in their verification process. Many of them are pretty inflexible with somewhat arcane processes designed decades ago (with ancient websites portals to match), so your experience may vary An additional detail is that there are two levels of code signing certificates, normal and EV (extended validation) certificate. EV certificates make windows completely drop the low-reputation screen and causes many antivirus solutions to trust you but are expensive and are a bit of a pain to get. Normal certificates are cheaper and comparatively easier to acquire, but only give partial benefits (less scary screen from Windows, some leeway from antivirus).
- rubymamis 2y ago
  Like wongarsu described, there are two types of certificates. I got the more trusted one (EV certificate) which has higher requirement standards (one of which is to be a formed corporation that is not a sole proprietorship).
- Nzen 2y ago
  For an EV certificate, you need to have a government-registered business [0], though a record of Doing Business As should be sufficient. Where I live, that involves filling a form, paying a fee, and taking out a classified add for 3 weeks [1]. There are cheaper certificates, OV, that merely require a notary public's confirmation (which is what I did). However, as the other post said, Windows will treat an EV certificate with very high trust and should not show SmartScreen. For OV signed software, it looks like [3] Microsoft will use some telemetry to assemble a trust score as people download and accept the risk of running the software, over days or weeks. [0] https://support.ksoftware.net/support/solutions/articles/35844-what-are-the-requirements-to-obtain-an-ov-or-ev-code-signing-certificate- https://support.ksoftware.net/support/solutions/articles/358... KSoftware is a sales partner for Sectigo. I used their service and later Sectigo directly, before last year's change to require FIPS hardware for managing the code signing certificate. [1] https://www.cookcountyclerkil.gov/vital-records/business-notary/assumed-business-name-registration https://www.cookcountyclerkil.gov/vital-records/business-not... [2] https://support.ksoftware.net/support/solutions/articles/232500-what-are-the-differences-between-ov-and-ev-level-code-signing-certificates- https://support.ksoftware.net/support/solutions/articles/232... [3] https://stackoverflow.com/a/65653792/504994 https://stackoverflow.com/a/65653792/504994
9cb14c1ec0 2y ago
Azure trusted signing for the win. Only $9.99/month.
- _mlbt 2y ago
  That is still more expensive than the $99 a year Apple charges, and you get al lot more than just signing for that price.
- rubymamis 2y ago
  Never heard of this! What kind of certificate does it support (oddly enough, it doesn't say on the website). Do you have experience with the process?
  - 9cb14c1ec0 2y ago
    Code signing cert. It works best as part of Github actions.
- JanisErdmanis 2y ago
  Can Azure sign MSIX application bundles with that subscription price?
huhtenberg 2y ago
> signing your app, which requires obtaining a certificate (which also requires forming a company that is not an LLC) and waiting more than a month while navigating multiple rounds of bureaucracy. This is not true, not as phrased. A. You can get a cert issued in your personal name. Not an EV one, but still. B. You are likely to already have a company if you are selling online. C. It doesn't take "a month" even for an EV cert. Several days tops unless you go through Comodo, in which case you get what you pay for. D. It is perfectly fine to distribute unsigned installers. They produce a warning on launch, granted, but contrary to the urban legend they are not getting instantly shit-canned by the Defender.
- rubymamis 2y ago
  A. Indeed, that requirement only apply to EV cert (at least for the cert authority I used). B. That's not always the case with indie developers. C. Well, it took me. My cert authority was GlobalSign. > but contrary to the urban legend they are not getting instantly shit-canned by the Defender. That was not my experience. Try to download an unsigned binary using Edge and see what happens. From what I remember (I'm on macOS, mostly), they are "getting instantly shit-canned".
  - lazyeye 2y ago
    There is a new approach to doing code-signing called "trusted signing". Havent used it myself so can't comment on the benefits https://www.advancedinstaller.com/trusted-signing-integration.html https://www.advancedinstaller.com/trusted-signing-integratio... https://learn.microsoft.com/en-us/azure/trusted-signing/overview https://learn.microsoft.com/en-us/azure/trusted-signing/over...
- mike_hearn 2y ago
  They don't produce a warning on launch, but browsers will make it hard to open unsigned installers. Edge makes it especially hard. Chrome less so.
- mceachen 2y ago
  Who was your EV cert vendor? I've recently used two different vendors, replied within minutes to each of their queries in hopes of expediting the process, but each time it took the better part of 2 months before I was in possession of a USB signing key. This is for a Delaware C-corp, so it was about as vanilla as it could be for their side.
bagels 2y ago
Just went through the code signing odyssey. It is a racket, but it did not take me a month. It took me a week and a half, including integration in to automated builds.
- crummy 2y ago
  How do the automated builds work? When I tried this five years ago a hardware dongle needed to be connected to the build machine.
  - bagels 2y ago
    Yes, there is a self hosted GitHub runner for signing. The token is installed on a desktop in the office that runs this.

pletnes 2y ago

As far as I understand, windows store is no longer available on enterprise windows. So if you want to sell a business app, it is not even an option.

MetaWhirledPeas 2y ago
It's still there on the version of Windows 11 I use at my office.
- pletnes 2y ago
  It’s gone on win10 at my office. With a «closed permanently» message.
- ItsBob 2y ago
  It doesn't come as standard on Enterprise 11. Source: I just installed Enterprise 11 on my desktop a week ago and I had to manually install Microsoft Store manually.

spacechild1 2y ago

> Standalone Windows installer is a must. 100% agree! I've been using Windows for over 20 years and I haven't installed a single app through Windows Store.

thr0waway001 2y ago

Can you elaborate on the ethical reasons? I should mention that I'm not very smart.

swyx 2y ago
he is standing on shoulders of giants, itd be nice if they just got a simple thank you.
me-vs-cat 2y ago
FFmpeg's license has various requirements, including: "Give prominent notice with each copy of the Combined Work that the Library is used in it and that the Library and its use are covered by this License."
- thr0waway001 2y ago
  Ok, I guess I had guessed correctly. Though I was curious if I had missed something.

firemelt 2y ago

can u elaborate more? why 1 year and small fee after?