Re:Notepad++ drops code signing for its releases
by juliusmusseau on Thursday March 07, 2019 @01:14PM
(#19330504)
My point was I would trust someone who drops $20 more than I would trust someone who drops nothing.
$61/yr (USD) will get you an OV cert - there are 10% discount codes that are easy to find for these guys, and their list price is $67/yr:
https://codesigning.ksoftware.net/
But the Notepad++ guy will need a business registered with that name before he can obtain CN=Notepad++, no matter how much he's willing to pay.
Re:Notepad++ drops code signing for its releases
by ex3ndr on Thursday March 07, 2019 @01:18PM
(#19330547)
This certificate doesn't help to bypass UAC and "unsecure" prompt still be shown to the user.
Re:Notepad++ drops code signing for its releases
by gruez on Thursday March 07, 2019 @01:50PM
(#19330901)
That's incorrect. All code authenticode signing certificates (trusted by microsoft) turns the UAC prompt from yellow to blue. EV certificates is probably for auto-trust for smartscreen.
Re:Notepad++ drops code signing for its releases
by Leace on Thursday March 07, 2019 @02:24PM
(#19331258)
> EV certificates is probably for auto-trust for smartscreen.
Yes, that's correct. EV just skips the reputation building phase.
Source: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...
> Programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher.
$20 doesn't get you an EV certificate anywhere.
We're talking about non-trivial hundreds of dollars per year, which is completely unsustainable for an open source driver for example.