<story><title>Microsoft Defender SmartScreen is hurting independent developers</title><url>https://getimageview.net/2020/06/02/microsoft-defender-smartscreen-is-hurting-independent-developers/</url></story><parent_chain><item><author>gregmac</author><text>I get the sentiment here, it&amp;#x27;s very annoying for developers (including me). Establishing trust is very hard problem, though.&lt;p&gt;Let&amp;#x27;s move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn&amp;#x27;t result in an identical or worse situation?&lt;p&gt;Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs -- &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;yourbank.real-secure-website.xy&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;yourbank.real-secure-website.xy&lt;/a&gt; can have a valid cert but it doesn&amp;#x27;t mean it&amp;#x27;s legitimate. What&amp;#x27;s the equivalent to the &amp;quot;URL bar&amp;quot; for software? What&amp;#x27;s the equivalent to the ACME domain validation challenge?&lt;p&gt;The SmartScreen stuff is another attempt at this -- software that&amp;#x27;s not frequently seen is flagged as a potential problem. As a developer, this annoys me greatly. As the de-facto support person for family that don&amp;#x27;t understand computers... I don&amp;#x27;t mind so much. Without this, malware gets executed directly and now you&amp;#x27;re dependent on (very imperfect) anti-virus software.&lt;p&gt;I guess the Store is another way to have &amp;quot;trusted&amp;quot; applications, but you only have to look at the Google Play or iOS store to see how well this ultimately works out (for both malware and legitimate authors).&lt;p&gt;Note this isn&amp;#x27;t even about admin vs non-admin installations. Obviously malware running as admin can do more damage that&amp;#x27;s harder to recover from, but non-admin malware is just as capable of doing bad things (think: stealing credentials, running cryptocurrency miners, ransomware), and after being hit by a randomware attack I doubt your &amp;quot;typical&amp;quot; user is going to really care much about the distinction between their account vs the entire computer being trashed.</text></item></parent_chain><comment><author>ebg13</author><text>&amp;gt; &lt;i&gt;What can Microsoft do, as an alternative, that doesn&amp;#x27;t result in an identical or worse situation?&lt;/i&gt;&lt;p&gt;Stop. Reasons for doing it at all are bullshit. If you want to evaluate the software, do that. I&amp;#x27;ll happily hand you the source code from GitHub and the build chain on AppVeyor so you can watch the executables being compiled. If you want to give me a way to mark my applications so that users know that they&amp;#x27;re picking up what I&amp;#x27;m putting down, great. I also care about my users, so I&amp;#x27;ll happily mark my applications.&lt;p&gt;But you don&amp;#x27;t need to take $100&amp;#x2F;year from me for the right to not have thugs block access.&lt;p&gt;&amp;gt; &lt;i&gt;Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates.&lt;/i&gt;&lt;p&gt;Malware exists to make money. Therefore malware authors can easily pay for certificates as a cost of business. Megacorp software fucks people over all the time. It exfiltrates their browsing history, MITMs their secure connections, installs rootkits and backdoors. Please don&amp;#x27;t pretend that this increases security.</text></comment>
<story><title>Microsoft Defender SmartScreen is hurting independent developers</title><url>https://getimageview.net/2020/06/02/microsoft-defender-smartscreen-is-hurting-independent-developers/</url></story><parent_chain><item><author>gregmac</author><text>I get the sentiment here, it&amp;#x27;s very annoying for developers (including me). Establishing trust is very hard problem, though.&lt;p&gt;Let&amp;#x27;s move this to a productive conversation though. What can Microsoft do, as an alternative, that doesn&amp;#x27;t result in an identical or worse situation?&lt;p&gt;Giving out free code-signing certificates also makes it easier for malware to get legitimate certificates. This is akin to LetsEncrypt for certs -- &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;yourbank.real-secure-website.xy&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;yourbank.real-secure-website.xy&lt;/a&gt; can have a valid cert but it doesn&amp;#x27;t mean it&amp;#x27;s legitimate. What&amp;#x27;s the equivalent to the &amp;quot;URL bar&amp;quot; for software? What&amp;#x27;s the equivalent to the ACME domain validation challenge?&lt;p&gt;The SmartScreen stuff is another attempt at this -- software that&amp;#x27;s not frequently seen is flagged as a potential problem. As a developer, this annoys me greatly. As the de-facto support person for family that don&amp;#x27;t understand computers... I don&amp;#x27;t mind so much. Without this, malware gets executed directly and now you&amp;#x27;re dependent on (very imperfect) anti-virus software.&lt;p&gt;I guess the Store is another way to have &amp;quot;trusted&amp;quot; applications, but you only have to look at the Google Play or iOS store to see how well this ultimately works out (for both malware and legitimate authors).&lt;p&gt;Note this isn&amp;#x27;t even about admin vs non-admin installations. Obviously malware running as admin can do more damage that&amp;#x27;s harder to recover from, but non-admin malware is just as capable of doing bad things (think: stealing credentials, running cryptocurrency miners, ransomware), and after being hit by a randomware attack I doubt your &amp;quot;typical&amp;quot; user is going to really care much about the distinction between their account vs the entire computer being trashed.</text></item></parent_chain><comment><author>acaloiar</author><text>&amp;gt; What can Microsoft do, as an alternative, that doesn&amp;#x27;t result in an identical or worse situation?&lt;p&gt;Microsoft can recognize that pay-to-play certificates are merely assets owned by developers; not developer identities. Microsoft needs to manage identity relationships with developers in a way that is indepdent of certificate aquisition and expiry.&lt;p&gt;The certificates themselves are merely an implementation detail of identity.&lt;p&gt;With that said, I don&amp;#x27;t condone the corporate gate-keeping of software development and recommend developers not contribute to any platform that requires indie developers to pay to become a part of the ecosystem. Long live open source.</text></comment>