275
« Last post by db90h on October 31, 2011, 08:16 PM »
Since many don't understand this issue, let me explain more thoroughly.
I worked for a security company for years. This debate went on for years. Some wanted to disallow ALL UNSIGNED EXEs... As they did with Vista+ x64 drivers. However, some of us, including me, fought to make it so unsigned EXEs could be run. Of course, backwards compatibility also strongly encouraged this. So, consider yourselves lucky Microsoft didn't decide to put even stronger warnings on unsigned EXEs, or disallow them to be run at all, especially for 64-bit code, where new code had to built anyway (reducing the complications of backwards compatibility).
This change happened in Vista, where, if you never noticed, the UAC elevation prompt for unsigned EXEs has a much more ominous warning than a signed EXE.
The cost last I checked was (always going down) $80 a YEAR. That is $6.66 a month. So, eat one or two less cheeseburgers a month. Even enthusiasts can afford that. The cost of electricity to build the software is probably higher than that. If the cost was $1000 a year, my stance would be different - and so would Microsoft's.
Us engineers are ALWAYS trying to protect the 'small guy' against the 'big business'. Yet, these sort of criticisms come, and it is the malware authors you should blame -- not anyone else.
There is a cost to doing almost anything, and this is one additional (small) cost of publishing software. If you don't want to pay this 'fee', then you can publish unsigned EXEs and tell your users to ignore the security warnings, explaining why.
Now, I've helped you understand why this is so. Do you understand? The malware problem mandated it, and you are lucky the warning isn't worse, and that your code runs at all. As I've said, throughout history, the 'bad guys' come in and force legitimate businesses (or hobbyists) to incur additional overhead in order to prove their trustworthiness. As explained above, the mere presence of a cert doesn't mean much, it is the history of that cert that ends up counting. All security vendors track how good of a history your cert has shown. That is how things are done now, and why unsigned EXEs are potentially inherently more risky.
I do not mean to offend, but you are about 5 years behind the times on this 'debate' ... The debate is long over, and there is no changing things now. I know many here want a world where everything is free. Well, that isn't the utopia we live in. I wish it were. But it isn't. You aren't going to force Microsoft to change a policy they debated for years because you can not afford a cert (hard to believe if you can afford hosting, but.. whatever).
Now, I've helped you get up to speed on things. Don't take your anger, if there is any, out on the messenger.
Recent Posts
.