What software can’t run on Windows without Microsoft’s blessing?

Anything that isn't signed with certs from Microsoft-blessed CAs, anything that is signed with certs that were revoked either by Microsoft or their blessed CAs, and anything newly signed with old certs that weren't renewed for a $100+/yr fee. That, or you upload your app to Azure for cloud signing where Microsoft decides to bless it or not, and you might pay less than going with a full code signing cert from a CA.

Ran into this fun issue a while back[1].

[1] https://news.ycombinator.com/item?id=40815488

Sorry you hit that bug but you can definitely run unsigned code on windows.

Never claimed you couldn't, try distributing that unsigned code and see if your users can figure out how to run it, or if their OS will gaslight them into thinking they just downloaded a virus, or if they get past that, if they can get past the additional warning window that purposely doesn't show[1] the "Run anyway" button that lets you run what you want.

[1] https://learn.microsoft.com/en-us/answers/questions/4270245/...

Well you did claim that, but thank you for correcting. So that warning is bad for a developer because of confused and annoyed users, but in terms of actual user restriction it's not super bad. If defender is set to be too aggressive, that's a one time change, so about on par with Android. And for the normal (I think? Did the default change?) setting you just use run anyway. That's far away from how iOS makes it impossible.

Edit: Everything I can find says that taking away the "run anyway" button is not default. If a user or their sysadmin changes that setting I don't really blame Microsoft.

No, this is what I claimed:

> I'd be okay giving Microsoft whatever they wanted on the Windows app store as long as they loosened their grip on being able to run what you want, from where you want, without their explicit blessing.

I am talking about their grip on what you're allowed to run with or without their blessing, not that you "can't run unsigned binaries at all". They have a tightened grip, in that without their blessing, running what you want is an exercise in futility for 99% of users.

> Edit: Everything I can find says that taking away the "run anyway" button is not default. If a user or their sysadmin changes that setting I don't really blame Microsoft.

It's exactly what I experienced when running an unsigned binary in a fresh Windows 11 VM with the default Defender settings, which are all on by default. This is how SmartScreen works by default with binaries it doesn't like.

Okay, that new default is a significant worsening.

> what I claimed

Your first comment was fine. Your response to nandomrumber was the problem. They asked about "can't run" and you gave a big list of situations that are interference but not "can't run".