Hacker News Reader

> Well, the "Smart" screen says that WinMerge and KDiff3 are malwares.

I've got WinMerge installed on my machines and I've never had that issue. Are you sure you're using trusted sources?

I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself.

> Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen, I can inspect their code.

> I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself.

So, you don't actually know what code you're running and that binary actually could be malware.

Yes, and original comment addresses that. In theory WinMerge binary can contain malware. But WinMerge authors have a proven track record against that and they are transparent about working of their application enough through their source. MS and Smartscreen do not have that track record, and IMO have an opposite kind of record with all kind of map/adware practices throughout the system and applications.

So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more?

> So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more?

I honestly don't understand how you've made this an adversarial situation. It's almost as if you take offense to Smartscreen telling you it doesn't trust your binary.

The system is pretty straight forward, Smartscreen checks the file source against a list of known bad actors. If there's a hit it's saying "I can't vouch for this".

I checked and WinMerge isn't flagged in Smartscreen. The publisher however does not use a signing certificate which results in a UAC prompt.

In any case neither of these features prevent installation, they're just warnings you can circumvent.

If you don't trust SmartScreen, you'll also don't trust Windows, so using Windows is the problem rather than SmartScreen.

Smartscreen does not tell you that WinMerge is malware. It correctly tells you that the freshly compiled build from GitHub is not a commonly used software which makes it more likely to be dangerous. How is that a bad feature to have?

How is that a good feature? Just because something is not commonly used it stops being good? When most software was proprietary and FLOSS was nascent, MS argued that FLOSS was bad, was that right?

Conversely, just because something is used more, does that get the automatic stamp of approval? More than 2 Billion people use Facebook every month, do you consider FB to be more likely to be good for someone? What kind of messed up logic is that?

No. Smartscreen is not meant to single-handedly solve the entire problem of malware. It is just meant to warn you when you are running software that isn't commonly used. It is nothing more than an attempt to provide the user with a useful heuristic. It does not make moral judgements about the software you use like you are saying here.

Only warning people when it isn't common used is a judgment. Why is software that isn't commonly used a danger? Where do you set the limit? Is infrequently used software signed by Microsoft dangerous?

Showing a warning about anything is not value neutral. Showing a popup for infrequently used software says that you value number of users as a measure of software quality.

But this is empirically not a good heuristic ?

It usually makes you have a quick rundown about what you are trying to run. If it's some software I got from the projects original GitHub page I make a note of that and proceed. If it's something that should surely not be "rarely used" (eg. A browser,video player,torrent client, etc) I think twice.

That is fine but probably not good for most users. It is easy to tell it not to filter those apps. You can make exceptions. Just shutting it off totally is like changing a router to allow all ports and traffic in because it blocked a port you were using vs making a firewall rule.

Like I found that SmartScreen and defender blocked my ethminer but that is in general pretty smart because it is common to have it unwittingly installed, and I simply said it is OK to run.

“ I don't run unauditable things like Smartscreen on it.” You mean, like Windows?

I use both of these and have never received a malware indication. Sounds fishy.

For WinMerge it should be noted that some web-sites out-there offer winmerge binaries for download and I bet that some of them are bundled with spyware (they are not affiliated with the official version, but even my tech-savvy friend was about to download winmerge the other day from a non official source, I noticed him that he should use winmerge.org).

I get the binaries from GitHub repo directly.

It sounds like you, sir or madam, need to get rid of Windows entirely. May I suggest macOS (and Parallels running Ubuntu Linux if you like WSL)?

macOS isn't any better in that regard. Some software takes 30+ seconds of Apple "verifying" before the application is even launched.

This usually comes up as a problem when you try running a large application from a compressed disk image.

Copy the application out of the disk image first. Verifying the application (and running it) will be much faster.

Honestly, I'd rather disable that feature entirely. It adds zero value for engineers like us.

Besides the recent outage snafu, when does this happen? I haven’t seen it.

This is a work machine. My personal laptop runs NixOS.