3 ms·

> signing your app, which requires obtaining a certificate (which also requires forming a company that is not an LLC) and waiting more than a month while naviga

> signing your app, which requires obtaining a certificate (which also requires forming a company that is not an LLC) and waiting more than a month while navigating multiple rounds of bureaucracy. This is not true, not as phrased. A. You can get a cert issued in your personal name. Not an EV one, but still. B. You are likely to already have a company if you are selling online. C. It doesn't take "a month" even for an EV cert. Several days tops unless you go through Comodo, in which case you get what you pay for. D. It is perfectly fine to distribute unsigned installers. They produce a warning on launch, granted, but contrary to the urban legend they are not getting instantly shit-canned by the Defender.

rubymamis 2y ago
A. Indeed, that requirement only apply to EV cert (at least for the cert authority I used). B. That's not always the case with indie developers. C. Well, it took me. My cert authority was GlobalSign. > but contrary to the urban legend they are not getting instantly shit-canned by the Defender. That was not my experience. Try to download an unsigned binary using Edge and see what happens. From what I remember (I'm on macOS, mostly), they are "getting instantly shit-canned".
- lazyeye 2y ago
  There is a new approach to doing code-signing called "trusted signing". Havent used it myself so can't comment on the benefits https://www.advancedinstaller.com/trusted-signing-integration.html https://www.advancedinstaller.com/trusted-signing-integratio... https://learn.microsoft.com/en-us/azure/trusted-signing/overview https://learn.microsoft.com/en-us/azure/trusted-signing/over...
mike_hearn 2y ago
They don't produce a warning on launch, but browsers will make it hard to open unsigned installers. Edge makes it especially hard. Chrome less so.
mceachen 2y ago
Who was your EV cert vendor? I've recently used two different vendors, replied within minutes to each of their queries in hopes of expediting the process, but each time it took the better part of 2 months before I was in possession of a USB signing key. This is for a Delaware C-corp, so it was about as vanilla as it could be for their side.
- huhtenberg 2y ago
  It used to be Digicert, but they hit the rock bottom and went straight below it after their merge with Symantec. Quadrupled their prices by forcing everyone on subscriptions, obnoxious sales people, sales phone calls, price negotiations, the whole shebang. However, their validation team is still the best. It took some searching, but it turns out that they spun off their non-subscription certificate business under the name of GoGetSSL. This entity resells other vendors too, but if you get their "own" certificate, which is the cheapest of the bunch, the validation is done by Digicert. So, that's the answer for the time being. Entrust, Globalsign, Certum are way more expensive, slow and bureaucratic. Comodo (or Sectigo, which is the same thing) are just utter crap. Their validation process is an India-outsourced torture. Never again. Not even for free.

rubymamis 2y ago

A. Indeed, that requirement only apply to EV cert (at least for the cert authority I used). B. That's not always the case with indie developers. C. Well, it took me. My cert authority was GlobalSign. > but contrary to the urban legend they are not getting instantly shit-canned by the Defender. That was not my experience. Try to download an unsigned binary using Edge and see what happens. From what I remember (I'm on macOS, mostly), they are "getting instantly shit-canned".

lazyeye 2y ago
There is a new approach to doing code-signing called "trusted signing". Havent used it myself so can't comment on the benefits https://www.advancedinstaller.com/trusted-signing-integration.html https://www.advancedinstaller.com/trusted-signing-integratio... https://learn.microsoft.com/en-us/azure/trusted-signing/overview https://learn.microsoft.com/en-us/azure/trusted-signing/over...

mike_hearn 2y ago

They don't produce a warning on launch, but browsers will make it hard to open unsigned installers. Edge makes it especially hard. Chrome less so.

mceachen 2y ago

Who was your EV cert vendor? I've recently used two different vendors, replied within minutes to each of their queries in hopes of expediting the process, but each time it took the better part of 2 months before I was in possession of a USB signing key. This is for a Delaware C-corp, so it was about as vanilla as it could be for their side.

huhtenberg 2y ago
It used to be Digicert, but they hit the rock bottom and went straight below it after their merge with Symantec. Quadrupled their prices by forcing everyone on subscriptions, obnoxious sales people, sales phone calls, price negotiations, the whole shebang. However, their validation team is still the best. It took some searching, but it turns out that they spun off their non-subscription certificate business under the name of GoGetSSL. This entity resells other vendors too, but if you get their "own" certificate, which is the cheapest of the bunch, the validation is done by Digicert. So, that's the answer for the time being. Entrust, Globalsign, Certum are way more expensive, slow and bureaucratic. Comodo (or Sectigo, which is the same thing) are just utter crap. Their validation process is an India-outsourced torture. Never again. Not even for free.