Re:Notepad++ drops code signing for its releases
by Sephr on Thursday March 07, 2019 @12:55PM
(#19330289)
K-Software does not sell EV certificates for $85/yr. They start at $349/yr.
The parent comment's issue is that EV certificates are essentially required due to the poorly-designed SmartScreen reputation filter. The $85/yr certificate you're mentioning doesn't help solve this.
Re:Notepad++ drops code signing for its releases
by GordonS on Thursday March 07, 2019 @01:20PM
(#19330564)
I didn't know about the EV workaround and the OP didn't mention it.
I've never used an EV cert before for code signing. When we first started, I think Smartscreen was a nuisance for about 2 weeks, but years on, and I've never had to think about it again. Even when we've renewed the cert.
Re:Notepad++ drops code signing for its releases
by Boulth on Thursday March 07, 2019 @01:45PM
(#19330841)
Thanks for taking the time to describe your experience.
When you renewed the cert did you use the same key pair? (I'm wondering how does Microsoft correlate reputation).
Re:Notepad++ drops code signing for its releases
by GordonS on Thursday March 07, 2019 @01:47PM
(#19330869)
No, it was a new key pair each time. I'm also rather interested to know how it decides reputation though!
Re:Notepad++ drops code signing for its releases
by Boulth on Thursday March 07, 2019 @02:34PM
(#19331369)
Probably based on Subject name. It'd require a lot of money to verify that though (e.g. buying cert from another CA with the same name).
Re:Notepad++ drops code signing for its releases
by flohofwoe on Thursday March 07, 2019 @12:56PM
(#19330301)
IME Windows SmartScreen still gives a scare-warning for software that's signed with a valid certificate, unless some magic "reputation-threshold" is reached and who-knows what factors into this.
The current code-signing-certificate model is pointless, regardless of price.
Re:Notepad++ drops code signing for its releases
by GordonS on Thursday March 07, 2019 @01:36PM
(#19330736)
I didn't realise that. We released desktop software several years ago, and customers/trialers did report that Smartscreen was flagging it for a couple I'd weeks. Never had an issue since then though.
Having said that, Smartscreen is opaque, and a nuisance.
I've used them for years and can recommend them.