News for hackers. Stuff that matters.
Re:Notepad++ drops code signing for its releases by GordonS on Thursday March 07, 2019 @12:47PM (#19330190)
You can get a certificate far cheaper than that - K-Software offer them for $85/year.

I've used them for years and can recommend them.

Re:Notepad++ drops code signing for its releases by Sephr on Thursday March 07, 2019 @12:55PM (#19330289)
K-Software does not sell EV certificates for $85/yr. They start at $349/yr.

The parent comment's issue is that EV certificates are essentially required due to the poorly-designed SmartScreen reputation filter. The $85/yr certificate you're mentioning doesn't help solve this.

Re:Notepad++ drops code signing for its releases by GordonS on Thursday March 07, 2019 @01:20PM (#19330564)
I didn't know about the EV workaround and the OP didn't mention it.

I've never used an EV cert before for code signing. When we first started, I think Smartscreen was a nuisance for about 2 weeks, but years on, and I've never had to think about it again. Even when we've renewed the cert.

Re:Notepad++ drops code signing for its releases by Boulth on Thursday March 07, 2019 @01:45PM (#19330841)
Thanks for taking the time to describe your experience.

When you renewed the cert did you use the same key pair? (I'm wondering how does Microsoft correlate reputation).

Re:Notepad++ drops code signing for its releases by GordonS on Thursday March 07, 2019 @01:47PM (#19330869)
No, it was a new key pair each time. I'm also rather interested to know how it decides reputation though!
Re:Notepad++ drops code signing for its releases by Boulth on Thursday March 07, 2019 @02:34PM (#19331369)
Probably based on Subject name. It'd require a lot of money to verify that though (e.g. buying cert from another CA with the same name).
Re:Notepad++ drops code signing for its releases by flohofwoe on Thursday March 07, 2019 @12:56PM (#19330301)
IME Windows SmartScreen still gives a scare-warning for software that's signed with a valid certificate, unless some magic "reputation-threshold" is reached and who-knows what factors into this.

The current code-signing-certificate model is pointless, regardless of price.

Re:Notepad++ drops code signing for its releases by GordonS on Thursday March 07, 2019 @01:36PM (#19330736)
I didn't realise that. We released desktop software several years ago, and customers/trialers did report that Smartscreen was flagging it for a couple I'd weeks. Never had an issue since then though.

Having said that, Smartscreen is opaque, and a nuisance.

Re:Notepad++ drops code signing for its releases by ilaksh on Thursday March 07, 2019 @02:50PM (#19331562)
I recently got an $85 certificate from k-software which is actually Comodo now Sectigo. It was a nightmare. Took two months and fifty emails.