Hacker News Reader

Comment by GeekyBear | Hacker News Reader

To avoid having your application blocked by Windows SmartScreen, you need to pay extra for an extended validation code signing certificate. A normal code signing certificate is not sufficient.

Here's an eight year old Stack Overflow discussion of the issue:

> A guaranteed way to immediately and permanently get rid of the Microsoft SmartScreen warnings is to buy an "Extended Validation" (EV) code signing certificate from one of the Microsoft-approved certificate authorities (CA's), and to sign your app with that EV certificate.

Such an EV certificate will typically cost you somewhere between 300 and 700 USD per year (you better compare prices), and will only be issued to registered businesses. If you're a single developer, you must be a sole proprietor and have an active business license.

https://stackoverflow.com/questions/48946680/how-to-avoid-th...

View on HN

Microsoft say it's no longer true that EV certificates get special treatment:

https://learn.microsoft.com/en-us/windows/apps/package-and-d...

The only option to avoid a SmartScreen prompt from day 1 on Windows is to distribute through Microsoft Store, end of story.

If you sign it yourself, via Azure or your own $200/year cert, you will get a SmartScreen prompt initially, but the prompt will stop appearing once the file hash has sufficient download history. There is no exact threshold, but it can take several weeks and hundreds of clean installs from a wide audience.

This is from https://learn.microsoft.com/en-us/windows/apps/package-and-d...

I have an OV cert for Windows, which is expensive enough. I just make sure to do a snapshot release using the new certificate to existing customers (through my newsletter and forum) a while before using it for new customers. That way there is time for the scary warnings to go away before any new customers see them.

Digital certificates providers are basically checking your id (mostly automted) and multiplying 2 prime numbers together. Then charging you several hundred dollars. A 1 year Sectigo certificate EV with USB key is $431.99. Nice work if you can get it.

I wrote this back in 2008:

https://successfulsoftware.net/2008/02/27/the-great-digital-...

But it has got much worse since then.

I don't think this is true. A normal CS signing cert is sufficient for most commercial apps - you will get the SmartScreen warning for a few days but it will go away fairly quickly.

The important part is that SmartScreen reputation is URL-based, you need to make your initial download URL consistent. If you are constantly rewriting it (i.e. with a version #) it will break. It's ok if the original URL hits a 302 to the latest version.

Reply on news.ycombinator.com