Hacker News Reader

Comment by klabb3 | Hacker News Reader

Does anyone know how this software passed Microsoft smartscreen and typical antivirus apps? As someone distributing legitimate software on Windows, I feel like I was heavily scrutinized and getting code signing certs was a real pain, and costly. What's the purpose if it can't even weed out crap like this?

View on HN

They probably just tell the user to bypass the prompts. For example, my college roommate went to great lengths to install what he thought was a Pokémon blue emulator on his laptop. All the security checks in the world won’t protect a user determined to silence them.

I don’t know that’s what happened here, but it sounds like some of the installs were PPI, so I wouldn’t be surprised. That basically means anyone who can figure out how to bundle the software with an artifact can distribute it. A long time ago, and probably today too, people used to crack popular programs, bundle some adware into them, and then seed the torrent. The user is already committed to circumventing security checks and entering strange commands, so I can imagine how they might end up installing some bonus executables in the process.

All the security checks in the world won’t protect a user determined to silence them.

And that is IMHO a good thing. The alternative is a world where no one has any freedom.

Just to play devil's advocate, what about situations where someone's freedom to use software encroaches on others? For example, what if a user uses those freedoms to install malware that adds their machine to a botnet?

Same as freedom to put poison in your own food vs poison in someone else's food.

They're different things.

Everything you do in this world "enroaches on others" to some extent. One of the core tenets of freedom, at least in the West, is that we need to allow a certain amount of that and consider the fact that people will not always do what you want as a necessary condition for freedom to exist.

Yes exactly, the point I guess I was arguing with is how you define 'a certain amount' of freedom. Freedom is clearly not absolute in the real world so why should it be absolute in the digital one? Particularly when the overwhelming majority of 'normal' people do not care about the basics of digital hygiene and security.

There was a time I had a very Stallman view on software. Now I think my views are that having closed source devices, where security is managed by 'trusted' third parties, is absolutely fine for people who don't care. However, there should always be a choice for those who do want to exercise their freedom, and typically those who care about their digital freedoms will be technical enough to manage their devices responsibly. Clearly though in the mobile market in particular we're very far away from realising this.

Consider that it's illegal to drive a car without working headlights or taillights, but cars aren't required to disable themselves if they detect a lightbulb is burned out.

I'm not sure I understand your analogy. My thoughts were along the lines of users unintentionally installing malware which inflicts harm onto others, or say refusing to install software updates 'because it works' which in turn puts others at risk.

But to use that car analogy, in my country it is a legal requirement to have your car undergo a safety check every year for cars older than a certain age. That is very analogous to installing software updates in my opinion, and yet we don't enforce legal requirements to install updates on personal devices.

I guess my point is that if you want to break the law, things that you own shouldn't prevent you from doing so.

Smartscreen has always been a joke.

I hoped with Lets Encrypt we were past the days of paying for cryptographic signatures, but Microsoft is keeping the legacy alive

AFAIK Lets Encrypt does not provide free code-signing certificates, but I did hear of a group that was trying to do that. Can't recall the name right now.

This one maybe? https://www.sigstore.dev/

> What's the current status?

> We’re working hard to release v1.0 in July.

Hopefully they are close to release.

It's an absolute sham and Microsoft is using their market dominance to give us a worse product for more money.

I would love to see someone start a Windows app store that's based on domain validated code signing. Domains are better trust indicators than business names IMO.

Reply on news.ycombinator.com