Hacker News Reader

Comment by missedthecue | Hacker News Reader

When this happened to my software product I fixed it by purchasing a Comodo EV code signing certificate. It cost me $502, it was FedExed to me in a USB, and I signed my program. Tens of thousands of installs later, I have never had an issue with smart screen. Note that there are two types of code signing certs, you want the EV Code Signing Certificate. It will instantly give your program reputation that ends the smartscreen filter issue.

Is it a corrupt system? Pay to play? Sure. But this is a guaranteed way to solve the problem. And way cheaper and 1000x faster and less of a headache than contacting an attorney (which a surprising number of people here are recommending!)

View on HN

> It cost me $502, it was FedExed to me in a USB, and I signed my program.

I’m surprised that it apparently had to be delivered physically. Did Comodo generate the private key for you?

IIRC you are able to get the cert signed to an existing HSM USB (depends on the provider tho).

The point is the private key is on the USB gadget and stays there. It's not a dumb USB drive.

Looks like protection racket.

Well, when you're driving and you get pulled over, you show your driver's license to the police and they don't arrest you for driving without a license.

It seems like asking to run code on other people's machines is a privilege, too. Unfortunately the World Wide Web has trained consumers to grant that privilege willy-nilly to every web page they visit. I am thankful that code signing and validation is ending the party in that way.

Sure, but "Pay $502 for the privilege of running code on other people's machines" doesn't seem like a big improvement?

At least to get a driver's license you need to pass a driving test, and return periodically to update the photo and pass an eye exam.

Yes, but quis custodiet ipsos custodes?

With the driver's license, the police officer can usually easily see if you've been behaving like someone who found their license in a packet of chips or not.

Does the certificate issuer perform any kind of due diligence to determine if the certificate should be given to this program?

Racket protection's determining characteristic is that the outfit can't care less what you do as long as you pay your dues and don't cross them. And if you don't, it doesn't matter how upright a citizen you are or how paranoid about safety you are, your shop will burn.

The code-signing certificate says nothing about whether the program is worthy. The code-signing certificate authenticates the publisher. That's how it's supposed to be used. The due diligence for code security is up to the publisher, because they're staking their reputation by certifying it.

The certificate authorities are separately run, by the way. I don't know how you could say Microsoft has a protection racket when they accept certificates from disparate authorities.

Code-signing certificates enable users to discern reputation. A certificate confers a reputation and not holding a certificate means an unknown reputation.

If I drive a car without a license, I can probably drive that car for years as long as I'm obeying laws and not causing trouble. A police officer who pulls me over may perhaps not ask for a license after all, but he doesn't know my reputation of obeying traffic laws; he's got to check my privilege. A driver's license in my jurisdiction carries reputation beyond just the driving privilege: infractions will rack up points.

Reply on news.ycombinator.com