Hacker News Reader

Comment by eps | Hacker News Reader

An EV sig on .exe automatically whitelists any it with SmartScreen. It still shows a message, but a far less scary one.

Edit - hmm, it sounds like the dev got an EV cert though, because regular ones don’t require storing keys on a token. So I’m not sure what’s going on here...

View on HN

I think a proper EV should not show any warning at all. The issue here is using SHA1 instead of SHA256, not sure why op would do this. SHA1 signing was deprecated..

https://www.globalsign.com/en/blog/microsoft-announces-updat...

One reason is that if signing via the Mono Framework, the only signing method it offers is SHA-1. I had to eventually sign with `osslsigncode` to get this right. I was trying to cross-compile a Windows app on Linux, which is why the Mono solution appeared to make sense.

Our EV cert shows an alert. Very fucking annoyed if I’m honest. And yes it was SHA-256.

Several days and a pile of cash fucking around with WIX and signtool for what exactly?

Check this Stack overflow thread. For us it was cached SHA1 certificates in the cert chain:

https://security.stackexchange.com/questions/109629/deprecat...

But yeah, it's a pain..

Thanks for the link. I don't think it was that but I'm going to check it thoroughly anyway.

Thanks! I was considering an EV, but will now opt for the poor option.

It's essentially a protection racket with price segmentation.

It does feel like that. We don't actually issue a signed copy now and we have had precisely one complaint and that was from an enterprise customer. We suggested they downloaded it themselves and gave them the sha256sum of the MSI and they were happy with that.

Reply on news.ycombinator.com