Hacker News Reader

I think a proper EV should not show any warning at all. The issue here is using SHA1 instead of SHA256, not sure why op would do this. SHA1 signing was deprecated..

https://www.globalsign.com/en/blog/microsoft-announces-updat...

View on HN

Our EV cert shows an alert. Very fucking annoyed if I’m honest. And yes it was SHA-256.

Several days and a pile of cash fucking around with WIX and signtool for what exactly?

Check this Stack overflow thread. For us it was cached SHA1 certificates in the cert chain:

https://security.stackexchange.com/questions/109629/deprecat...

But yeah, it's a pain..

Thanks for the link. I don't think it was that but I'm going to check it thoroughly anyway.

Thanks! I was considering an EV, but will now opt for the poor option.

It's essentially a protection racket with price segmentation.

It does feel like that. We don't actually issue a signed copy now and we have had precisely one complaint and that was from an enterprise customer. We suggested they downloaded it themselves and gave them the sha256sum of the MSI and they were happy with that.

One reason is that if signing via the Mono Framework, the only signing method it offers is SHA-1. I had to eventually sign with `osslsigncode` to get this right. I was trying to cross-compile a Windows app on Linux, which is why the Mono solution appeared to make sense.

Reply on news.ycombinator.com