I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself.

> Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen, I can inspect their code.

> I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself.

So, you don't actually know what code you're running and that binary actually could be malware.

Yes, and original comment addresses that. In theory WinMerge binary can contain malware. But WinMerge authors have a proven track record against that and they are transparent about working of their application enough through their source. MS and Smartscreen do not have that track record, and IMO have an opposite kind of record with all kind of map/adware practices throughout the system and applications.

So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more?

> So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more?

I honestly don't understand how you've made this an adversarial situation. It's almost as if you take offense to Smartscreen telling you it doesn't trust your binary.

The system is pretty straight forward, Smartscreen checks the file source against a list of known bad actors. If there's a hit it's saying "I can't vouch for this".

I checked and WinMerge isn't flagged in Smartscreen. The publisher however does not use a signing certificate which results in a UAC prompt.

In any case neither of these features prevent installation, they're just warnings you can circumvent.

If you don't trust SmartScreen, you'll also don't trust Windows, so using Windows is the problem rather than SmartScreen.