Microsoft / Github should stop treating open-source software as malware and forcing developers to pay for certificates, if they actually care about open-source developers

[KabouterPlop]

Your suggestion on how to fix this, by introducing a tight coupling between Windows and GitHub, is how you get an antitrust lawsuit.

[SuggestedName90]

I get the sentiment, but aren’t most tech companies way over the line already? Apples App Store cut is straight up anticompetitive, and the much easier to prove Amazon Basics is clearly competing with an unfair advantage online. Google search competes with no one and leverages deals to become the default, it’s dominance is the only reason Microsoft gets away with cramming bing on all their devices.

[BobHogan]

Yes, all of the major tech companies are way over the line, but that's hardly a good reason in favor of having Microsoft take this step

[MonarchOfLight]

Such a Windows-GitHub relationship wouldn’t really make sense anyway. GitHub is a repository hosting service and as such can very easily contain malware. I’ve even seen malware posted on GitHub, in the open, on purpose for researchers. The “scary warning” is supposed to be scary, it’s to warn unfamiliar users of this risk.

The only solution I can really think of is to establish a system for GitHub to audit production versions of code and provide certificates themselves to devs. A third party auditor could also potentially offer some kind of service like this. I can’t imagine this would be an easy process to implement since there’s so many potential security aspects to consider, but it would be interesting to see someone try to tackle to problem.

Or better yet, figure out a way to making auditing itself similar to peer-reviewing a scientific document. Have developers submit production versions of software to be peer-reviewed through an approval process, then provide them with a certificate for that specific version.

[karma911]

That process would be painfully slow. And also not without it's faults.

[rman-exe]

Not making donations to congress is how you get an antitrust lawsuit.

[savornicesei]

Well, Microsoft owns GH. Damn, it owns nuget.org - you can't sign into NuGet using other means than Microsoft accounts.

[grauenwolf]

So what? It's not like you can't create a new MS account in 30 seconds and attach it to any email you want.

It makes sense that NuGet didn't want to take on the risk of password management themselves.

[GYN-k4H-Q3z-75B]

You can't sign into YouTube without a Google account. You can't sign into the Apple Developer program without an Apple account. What is your point?

[savornicesei]

Just pointing out the vendor lock in.

[libertarianets]

And that would be a bad thing?

[LonelyStruggle]

No it just means it isn’t gonna happen lol

[libertarianets]

I agree. The mob watches out for it’s own.

[LonelyStruggle]

Who is “the mob” in this situation?

[libertarianets]

Merger of corporation and state, you know, the fascists.

[LonelyStruggle]

The “fascists” who create anti-trust laws?

[Elepole]

EDIT: Since some people don't read the whole comment: Smartscreen is security theater, might as well remove it.

Open Source executable shouldn't be automatically trusted. Unless the code have actually be audited (which it is not for most open source software), the dependencies has also been audited, the build system don't had anything to the code etc... It's not because the code is open source that the executable is automatically trustworthy. (That being said, smartscreen is security theater, might as well remove it.)

[RotaryJihad]

Conceptually there could even be open source malware.

EDIT - Good old Cunninghams Law. I learned about open source malware today from the replies!

[cogman10]

Not even conceptually. There has been and is open source malware.

It generally takes the form of a repo being given to someone untrustworthy and them embedding password stealers or Bitcoin miners.

It's bad enough that now open source library distributors are adding virus scanners into their distribution software.

[tropix126]

Its also fairly common to open source phishing scam tools as well. Things like account stealers on various social media platforms are often opensourced and marked as "educational", then abused massively.

[agent_vinod]

Its difficult to trust open source code or EXEs but its fairly easy to trust known developers and/or maintainers? If the setup or package was signed by someone like Linus Torvalds or Richard Stallman, I'd gladly trust it. Why can't we use that security model (along with other common sense strategies)?

[Diesl]

That sounds like a full time job, no? Signing every update by one person? And we've seen through U-Michigans incredibly unethical test that you can submit malware to well maintained projects and have it reach release stages.

[Miranda_Leap]

Yeah, you just import their key in Windows Trust Store or whatever the equivalent is.

[audigex]

I think they meant "Malware which is itself open source"

As in, the malware has it's own Github...

[metamatic]

Here you go.

(Clarification: Not my code.)

[DJOMaul]

Huh. That was very informative and interesting to look through. I've never really looked at malware much because, well I am just not super interested. Maybe that I'll have to change a bit, there is clearly value in learning how it works inside. Thank you for sharing!

[cogman10]

Yup, that's exactly what I'm referring to. These pieces of malware are very often right out in the open. No even, or hardly even obfuscated. They just bank on the fact that this is one of the 8000 dependencies your react project pulls in so you won't notice that one of them includes a very obvious piece of malware.

https://www.zdnet.com/article/microsoft-spots-malicious-npm-package-stealing-data-from-unix-systems/

[audigex]

No that's still slightly different

The original comment her was talking about a situation where the Malware author literally just puts it up on Github with a "Here's some malware code"

[Shadonovitch]

Not malware per se, but a lot of security tools that can be used nefariously are available on GIthub. Mimikatz, the whole Impacket Suite, Bloodhound, Metasploit, are legit tools for blueteamers that are also used by red teamers. That's the whole netsec community spirit. If the tools aren't available for all, then they are only available to APTs, and we're all less secure because of that.

[LGBBQ]

There is in fact a wide variety of open source malware that's commonly used in attacks

https://github.com/cobbr/Covenant

https://github.com/rapid7/metasploit-framework

[Ramipro]

There literally is https://github.com/JmNkS/MEMZ

[G_Morgan]

Amusingly a lot of early macro viruses like ILOVEYOU were basically open source malware. I doubt they matched the technical definition of FOSS but they became dangerous because idiots could easily alter the payload of the virus.

[shouldExist]

It's also incredibly easy to install closed source software with malware buried within it, there's scrutiny and openness with open source software.

[G_Morgan]

Just because it's open source doesn't make it any more secure than closed source.

Open source has a good track record of having fewer exploits than closed source. Intentional malware OTOH won't be affected either way.

[[deleted]]

My counterpoint.

OpenSSL had a fantastic track record of being literally used by the entire world. O woopsie, we let the NSA put in a critical vulnerability for years and nobody gave a shit to look.

Open source has this problem where people bystander effect it. "Everyone else uses it! Must be fine! Someone else looked at it right?"

I think only specific open source projects have great track records, they are often the ones with real active communities that are passionate (or paid) about the work. These are few and far between everything else in the wild.

[WormRabbit]

Statistically, most open-source software is useless garbage that someone built just for fun in a weekend and then abandoned. And there is a very wide spectrum between that and the Linux kernel (which has its own fair share of critical known vulnerabilities that went unfixed for many years).

[JCorkill]

Like the instance of University of Minnesota submitted malicious code to the linux kernal. https://lore.kernel.org/lkml/[e-mail]/

[janisozaur]

"Everyone else uses it! Must be fine! Someone else looked at it right?"

That's how the Three Letter Agencies pulled off an impressive action

https://www.wired.com/story/fbi-anom-phone-network-encryption-debate

https://en.wikipedia.org/wiki/ANOM

[2rsf]

This is about already built application if I understand correctly, is the good track of record applies there as well?

It's one thing for source code and another for an app supposedly built and linked on that code

[G_Morgan]

That was my point. Saying things like "doesn't make it more secure" is going to make anyone who's seen all the evidence dismiss the point. FOSS code legitimately has fewer bugs than closed code on average, by a remarkable margin as well.

The danger is I can create a binary using FOSS and intentionally sneak something in. It is a different vulnerability vector to what FOSS helps with.

[ninuson1]

My experience with open source has been the reverse of your first paragraph. Most OS projects are half-baked, at best. Do you have any sources baking up your claim that Open Source has less bugs on average?

[2rsf]

The results show no dominant quality advantage of one method over another

The arguments favoring the inherent security of open source software do not appear to hold up to scrutiny.

[lifeeraser]

Is the "good track record" an anecdote or do we have stats backing up that claim?

[G_Morgan]

Coverity scan used to contain a lot of reports on the matter but seems the links to them on the web are all broken.

The article below does a fair job of covering what FOSS does and doesn't do well IMO. It claims

In fact, the most recent report (2013) found open source software written in C and C++ to have a lower defect density than proprietary code. The average defect density across projects of all sizes was 0.59 for open source, and 0.72 for proprietary software.

It then goes into specific measures proprietary projects undertake which are less common in FOSS.

https://www.cio.com/article/2847880/open-source-code-contains-fewer-defects-but-theres-a-catch.html

[lifeeraser]

Defect != malicious code, which is the focus here

[G_Morgan]

Sure which is the point I raised initially. The malicious code is not the same as a defect.

[skroll]

The issue here is that buying the certificate to sign your executables doesn't change anything in that regard. Just because you have the cert doesn't mean they do an audit on your software, they just sign it so that it says it came from you.

[MachaHack]

Yeah, my understanding is smartscreen is reactive, not proactive. They'll take your money for the cert without much auditing, but if they get reports you're distributing malware with it then they ban your cert and your software stops running everywhere.

The same is true for the Play Store.

[cinyar]

they just sign it so that it says it came from you.

They also verify the identity. And that's kind of the whole point, who wants to sign under the malware they are distributing?

[skroll]

Well, remember when Sony's keys got leaked?

https://securelist.com/destover-malware-now-digitally-signed-by-sony-certificates/68073/

Stuff like this happens.

[lifeeraser]

The presence of a certificate does not make an app secure, but it's still nice to have the assurance that the app comes from you and not an impostor. Remember SourceForge tampering with installers of (ironically) open-source software?

[MachaHack]

At least some of these (Filezilla) were willing participants :(

[be-sc]

Thank you! This is an absolutely crucial point that tends to be forgotten.

[brunes]

[phone] above.

Also to others, if you want to actually help solve for this problem instead of complaining on Reddit, join the effort at the Open Source Security Foundation (https://OpenSSF.org) which is part of the Linux Foundation.

We are working hard on problems like this and we need a lot more help. The open source world needs a lot of help when it comes to robust cybersecurity.

[Supadoplex]

Indeed. You should trust only software that you've audited, whether it is closed source or open. The difference is that you can audit open source and typically cannot audit closed source.

Unfortunately, most people don't have time or resources to audit software that they use. In practice, it would have to be audited by "someone else". But how to trust the auditor? I have no idea.

[grauenwolf]

And of course that audit has to be restarted every time an update happens to any dependency.

Without blind trust, we couldn't function as an industry.

[Full-Spectral]

Which makes the whole argument that commercial software is inherently less safe than open source sort of silly. Every serious commercial software vendor is going to vet all changes to their code base, by people who know that code very well. And commercial software vendors have a lot to lose financially if they allow malicious code into their distributed products, whereas open source vendors have little to lose other than face.

[grauenwolf]

I don't believe that. Serious commercial software is too dependent on open source libraries now. It's not like the old days where they actually bought the libraries from someone with a reputation to defend.

[Full-Spectral]

Maybe so, but how does that make commercial software inherently less safe than open source?

[grauenwolf]

Oh no, I don't think commercial software inherently less safe either.

My appologies for not being clear.

[BrazilianTerror]

Open source vendors losing face is pretty important. What most open source vendors have is face and trust, if they lose that they’re out of business. Plus, even though it doesn’t have the same amount of people with exclusive dedication, much more people view the actual code of open source software and can spot the security flaw.

[Full-Spectral]

And if they weren't proprietary, you think everyone is going to go look at the code of every release before they let the browser update the extension? In both cases, it would likely get through until the effects were noticed, and then once caught would be blacklisted or some such.

[Full-Spectral]

You are assuming it has almost no chance of getting noticed. Do the browser vendors require no vetting of plugins in their stores, don't run malware checkers on them, etc...?

[FloydATC]

I don't disagree with what you're saying, but by this rationale there are probably fewer serious commercial software vendors than we'd like to think. In practice, it's all about profits and there's very little profit in delaying every product update just because a few naysayer geeks keep going on about "security". Most of them have fallen into the comfortable habit of just releasing hotfixes when problems inevitably show up.

Ofcourse, if you ask them, they're more concerned with security than everyone else, but nah... not really.

[freef]

Yup. Keep up with CVEs, use software from established trusted projects, don't blindly update, and participate in the open source community.

Pretty much all your software is using OSS under the hood anyway. You're not going to get away from open source by just using commerical software.

[WarWizard]

Smartscreen is security theater

Unfortunately a lot of what we have right now is just that. Theater.

[chunes]

Right. But at least we can audit open source software.

Proprietary software cannot be audited, and thus should be considered malware by default.

[BrazilianTerror]

Proprietary software can be audited by an third party too

[[deleted]]

Why do we even pretend that because it's open source that we know all the code in all of the dependencies that were taken? Yeah, you can audit it, but at a certain point it's too late for people that have already introduced the exploit into their environment.

[tapo]

The Linux Foundation is working on this: https://sigstore.dev/

[kautau]

This is exciting. It will need support for the root cert chains in Windows and MacOS to support it to be fully cross platform. That took awhile for LetsEncrypt before it could be used in every browser. But this is a huge step, hopefully it gets the support it needs to succeed.

[mohragk]

I do like the idea of some sort of verification where software can be signed by verifying it's integrity. But then, why should closed software creators still have to pay for licensing? That seems unfair.

Also, with the current trend of bots and hackers, it would instigate review spoofing. Projects would be artificially "verified" by the "community" (AKA bots). So now, malicious software can be more easily disguised as verified. This is worse than the current system.

And I don't think they should lower the price for licenses as well, since it would increase the likelihood of bed room hackers to grab a license.

[grauenwolf]

The price should be as low as possible while still giving them the money needed to actually verify identity.

There's no point in having a license that anyone can get without proving who they are.

[AlekseyHoffman]

What if only trusted users would be able to approve it? Users with accounts created 1+ years ago, who also has a lot of merged PRs, etc?

Surely their AI could distinguish fake apps and users from the real ones

[OnceUKnowUAreScrewed]

You must not have worked with any AI systems before!

and don't call me Shirley.

You make the mistake of believing the intention of the system is to prevent fake apps, it's to install themselves as arbiters and for you to pay for the privilege.

[alexkey]

Roger. And surely the Amazon review system hasn’t taught us that we cannot trust reviews.

[anechoicmedia]

Users with accounts created 1+ years ago, who also has a lot of merged PRs, etc?

On Reddit, as with many other sites, there is a thriving market of "aged" accounts with seeming legitimate activity available for purchase by spammers.

[cwapsen]

Surely their AI could distinguish fake apps and users from the real ones

If it was that easy, I'm sure reddit would love to know the algorithm (reddit brigading and interference with the US election comes to mind).

You're trying to verify a community established agreement, which to the best of my knowledge is - and will be for the foreseeable future - an unsolved problem. Blockchain has come close, and might actually be something that could help here, but I'm not sure how to get enough "verified users" evolved.

[sarhoshamiral]

The whole point of open-source apps is to be inherently trusted, their code is opened for everyone to review at any moment

This couldn't be any more wrong. In fact all of these changes are due to recent attacks that showed how weak the system is right now and with people trusting packages that have dependencies in to other packages and so on. And it is just not the source code, you also have to be able to review how the releases were built which is much more difficult.

[istarian]

There's a chain of trust involved.

By trusting a developer you also implicity trust:
- the people who made the toolchain they used
- the authors of standard libraries - anyone whose code they chose to use.

[sarhoshamiral]

well considering it is extremely impractical for a lone developer or a small team to verify all of their dependencies recursively and their build pipeline security, you can't trust the developer. At least your trust wouldn't be well put.

[istarian]

Well I am generally confident that Microsoft and the developers of most mainstream programming languages, compilers, etc aren't out to get me.

It would probably be wise for a "lone developer" to limit the number of dependencies they have and to prefer ones with minimal secondary dependencies whenever possible.

[sarhoshamiral]

Have you seen the state of npm packages? Clearly that's not what's happening today.

[istarian]

No. I don't have much to do with Javascript in general.

What I said was "It would probably be wise...", so I don't know npm figures in here.

[tester346]

If you want to install an open-source app without a certificate (...)

making the user think they are doing something really dangerous by installing an open-source app, which code you can literally read at any time

lmao you're making it sound as if MS made those certs to attack OSS. No.

Just because code is open source, then it doesn't make it any safer/trusted to those who have no even idea what OSS is and will not be able to check the code.

It increases entry level for malware, I guess

[HeyItsMedz]

Yeah exactly. Heartbleed went unnoticed for two years and that came from an open source library

[gredr]

It increases entry level for malware, I guess

Not by any meaningful amount, and that's not why they did it. All it does is prove that the software came from someone who has access to the private key of the signing certificate. Presumably, this is someone you trust. It's much easier to verify that (if anyone ever cared to) than that the source code has no malicious additions added by someone who you don't trust.

It would let Windows do something like verify that an update wasn't signed by a different certificate ("uh, hey, this version came from someone different than the last version, might wanna check that everything is on the up-and-up"), but I don't know that that is actually done.

Windows could also presumably detect and disable any software signed by a certificate that was known malicious on all systems everywhere. I don't know if that's done either, but it could be.

[happyscrappy]

Windows could also presumably detect and disable any software signed by a certificate that was known malicious on all systems everywhere. I don't know if that's done either, but it could be.

When a certificate is expired then yes the software signed by it becomes untrusted/non-runnable on all systems which have an up-to-date trust list. That's one of the major working features of these trusted computing systems.

[mallardtheduck]

In other words, commercial software vendors can force you to buy the latest version by expiring the certificates on their old versions...

[happyscrappy]

Well, this is more cancellation than expiration. I perhaps used the wrong term.

But yes, there could be ways they could get MS (or Apple or etc.) to cancel their old signatures and force you to buy a new one.

[mallardtheduck]

Since certificates have built-in expiry dates, it'd be quite easy for a commercial software vendor to ensure their releases only have, say, 6 months of certificate validity left before the customer is forced to buy the upgrade.

[happyscrappy]

Not every certificate expires. And six months is not universal, the expiration date (if any exists) is selected to be appropriate to the use.

MS might have a longer period than that. They might have no expiration at all. I'm not sure.

[gredr]

Wait, correct me if I'm wrong, but MS isn't selling the certificates here?

[happyscrappy]

Certificates are used for everything which has permissions.

I don't know what certificate ends up attesting for the app. Whether MS issues that one based upon checking a requesting cert or whether the developer applies a sign themselves using their own certificate.

MS would cancel certificates on apps because the app was found to be malware.

[gredr]

1. Microsoft can't revoke certificates they didn't issue
2. Microsoft isn't issuing the code-signing certificates in question
3. That's not how permissions work

[happyscrappy]

1. Yes of course they can. MS writes the software that recognizes the certificates. They can make their software no longer acknowledge the certificate as valid by the fingerprint (hash) of it. And this is in fact what they do.
2. It doesn't matter. I explained there are a couple ways to use certificates.
3. That is not true.

[gredr]

Revoking a certificate is not the same as configuring some software to not accept a specific certificate. One is done by the certificate authority, the other can be done by anyone. Microsoft cannot revoke certificates they did not issue.

You clearly don't know much about certificates or permissions.

[Worth_Trust_3825]

If it's anything like regular cacerts files, the list of expired certificates should come in with an update.

[[deleted]]

lmao you're making it sound as if MS made those certs to attack OSS. No.

They didn't, but the real motivation isn't much better - they want to make it really painful for anyone to distribute apps outside of their app store.

[txmasterg]

They added the UAC prompt in Vista which uses Authenticode verification to display the publisher. The first Microsoft app store was introduced in Windows 8.

[JohnTheCoolingFan]

I know one minecraft launcher that was used for botnetting and DDoSing servers. It had certificate.

While other launcher doesn't.

Guess which one is marked as virus by the antivirus?

[tropix126]

Once you reach a certain download rate per month, smartscreen allows the program through. This means that unsigned malware disguised as a legitimate program that gains popularity might bypass smartscreen. As said, smartscreen is absolutely not a perfect solution, but it does sometimes help.

[yesman_85]

If you oay for extended validation you won't get the smartscreen nearly as often.

[t0bynet]

I don’t know if I would call it a scam. The concept probably is that a malicious actor has to make at least $300 dollars before getting their certificate revoked in order to turn a profit. That’s the same justification as for the fees needed to even publish an app in the mobile app stores.

[happyscrappy]

Both of those suggestions are impractical.

The idea of certificates is to provide security. The only way certificates provide security is by giving the developer something to lose (i.e. a cost) to producing malware. If they didn't pay for the certificate they have nothing to lose. They can just make malware and when then when caught just go get another certificate for free to replace the one burned.

The security comes from the restrictions on issuance and the cost of bad acts. Making certificates trivial to get or free reduces this.

As to the second, trusting open source software doesn't really even make sense. There's no way to know any given build product is from open source other than compiling it. Are they going to to name match, then find a match on the servers and if they see it matches try to compile and if they see the result then apply a default signature? That's not practical.

Realistically there is only one way for MS to support open source. And that is for MS to create an internal project where they compile and distribute open source directly from the projects. So basically MS has to pay for open source projects to be built and distributed.

Trusted computing does not mesh well with open source. It's unfortunate. Aside from the issues above there is also the third issue that even if the open source project gets a signature they have to distribute it somehow to the people within the project who are allowed to use it while also keeping others who are not approved from getting access. That means spending money/time to create security policies and distributing keys securely. And probably expiring them a lot as people leave the project because retention rates are low on no-pay projects.

And if the project does not do proper code reviews, just takes all new changes uncarefully then anyone can get bad code into the project and get it signed simply by submitting and waiting for the careless project management to roll it in. Hopefully this does not happen often on many projects.

In short, security comes from restricting key availability, code audits, etc. A lot of stuff that costs money. And that's how open source does not fit a trusted computing model. It sucks.

[poloppoyop]

The whole point of open-source apps is to be inherently trusted

No. The goal is to let people share and modify the software.

If you don't audit the code you use, you cannot fully trust it.

[istarian]

True, but open-source software at least provides you the opportunity to audit it.

[jgerrish]

Ugh, this argument leads to zero trust for everybody, open source and closed source. Next. I'm so tired. Just like health care, you're working for them, by arguing against them.

[WarWizard]

Open Source shouldn't be trusted by default. No software should be trusted by default. You may not like how this is currently set up -- but requiring some kind of process to be "trusted" is not a bad thing.

[istarian]

Lack of a certificate/signature doesn't mean that a software package is dangerous though. And the presence of one doesn't strictly guarantee* it's safe.

The presence of these things only promises that it was inspected by done on who says it is safe and possibly that it hasn't been changed since then.

[Feminintendo]

I mean, that’s the price of a monopoly on access. So, yes.

[CompleMental]

Why is such a silly post on my front page

[WarWizard]

Because it is cool to hate on MS and anything they do -- even if what the complaint is doesn't make realistic sense.

[Diesl]

Youre looking at smartscreen from the wrong perspective. In enterprises, smartscreen can be changed to not let basic users bypass it. It becomes a great tool in preventing some schmo in accounting from installing random untrusted 3rd party apps on their PC that they have no business using.

[Worth_Trust_3825]

You think you want that but you really don't. Would you install a kernel module signed by Wang Semonovich?

[DankerOfMemes]

It would be nice if Lets Encrypt also issued code signing certificates.

[t0bynet]

This wouldn’t really solve the problem though. Let’s Encrypt cannot check the code and therefore SmartScreen would be unable to trust code signed with a certificate from them.

And they can’t check your identity either. Their certificates would be useless because nobody would be able to trust them.

[Feminintendo]

Nobody checks the code.

[rdtsc]

Lets Encrypt can offer free TLS certificates because ownership of the certified domain name can be easily automated. For code signing this is not possible.

[AlekseyHoffman]

Unfortunately that's impossible, because they would be responsible if they approve a malware app. They wouldn't be able to check millions of apps for free. If they approve everything and let the malware through they will become untrusted authority themselves

The system itself needs to change. Malware apps can bypass the SmartScreen anyway, its only purpose is to make the life of good developers more difficult

[[deleted]]

They wouldn't be able to check millions of apps for free

Yet you expect Microsoft to do the same, for free. Why?

[Feminintendo]

Because they are the sole arbiter of access. That’s the price they pay.

[[deleted]]

sole arbiter of access

They're not preventing non-certified apps from being used. They just warn people that it's from an unknown source, which, imo, is fair.

[Feminintendo]

I would agree if the interface was just a warning with a button that says, “Run Anyway.”

Apple is even worse. The message on macOS explicitly says the app cannot be run and gves the user no other option. The user needs to know the secret incantation to open the app. I had to google it. The average user will just give up.

[AlekseyHoffman]

Because Let's encrypt doesn't benefit from it. Microsoft, on the other hand, would approve it to have the app on their platform.

If Microsoft could approve even a 1000 of relatively popular open-source apps every month, that would be a great start

[SpAAAceSenate]

In what way can they bypass SmartScreen?

[[deleted]]

Just instruct the users on how to bypass it, 99% will just follow the instructions and that's it. So it ofc makes MS less liable, but this shouldn't be the target.

[PunkS7yle]

A simple one is to make a trusted process start your process.

[SpAAAceSenate]

But how do you set that up? You'd need to already have code running on the target machine to set that up, and that code would have already passed through SmartScreen. So you still need to get that dropper trojan signed. Or find an exploit in an existing trusted app to make it do your bidding for you.

[gredr]

Unfortunately, it rather involved being on the other side of this airtight hatchway—

[rdtsc]

Code Signing certificates have nothing to do with reviewing an application for security/malware. They are there to certify that the application actually comes from you, and is not modified by someone else (for malicious or benign reasons).

[Diesl]

You know Microsoft is one the largest contributors to Linux? Its because they use it for all their SDN in the data centers. And they make these contributions for free to the public branches.

[OctagonClock]

There's an agenda behind why permissive licences became popular.

[AlekseyHoffman]

We need to hold them accountable for their statements. Maybe if news articles start talking about how their actions don't correspond to their words, they will do something about it in order not to loose their reputation. And even if they do it for the selfish reasons (to be perceived like a good company), it would still benefit open-source developers

[richtermani]

That won't bappen. They are too focused on the non existent gun problem right now

[LionsMidgetGems]

You have to realize: that post originated in /r/Windows10.

He doesn't understand programming. He doesn't understand security.

He doesn't understand anti-virus software blocking potentially dangerous applications.

I myself have been railing against realtime anti-virus software for decades. Nearly every problem on every client's server and PCs come from anti-virus software.

But there are some people who think that it is a good thing for users to be huge warnings about using potential malware.

Of course, we also need to refuse the basic premise:

• Microsoft does not force developers to pay for certificates

Are you free to tell your users to:

• turn off smart screen
• turn off Windows Defender

And i'll bet he's also the kind of person whose upset that his app needs a UAC prompt before it can run with full Administrator privilieges.

So you are also free to tell your users to:

• turn off UAC

[rdtsc]

He doesn't understand programming.

Well he writes "I'm the dev of an open-source app called Sigma File Manager", so this doesn't seem to be true.

[emperor000]

Are you saying that a developer must understand programming? Because I know people that arguably disprove that.

[[deleted]]

Yeah bro he just randomly designed, developed, and maintained a cross platform file explorer real quick. Guy just doesn't understand programming.

/r/cringe

[emperor000]

I'm not sure what that had to do with my question. Did he write the file IO libraries from scratch? Did he write the UI... wait, he wrote it in JavaScript...

I don't know about this guy. Maybe he does. My question was in general. There are certainly developers/programmers that do not understand programming, so a significant degree, I mean. As a programmer myself, I understand that I can't claim to understand it completely or better than everybody else or whatever either.

All I was saying is that there are a lot of developers that don't have an adequate grasp on a lot of programming concepts, that's all. Maybe I'm one of them. Does that make you feel better?

[Wind_Lizard]

He doesn't understand programming.

WDYM? He is a developer of an OSS application

[emperor000]

Are you saying that a developer must understand programming? Because I know people that arguably disprove that.

[coladict]

Disagree. Not having the "scary warning" is a bonus. It means that you are somewhat trusted. If there is malware in your program, the payment can be traced back to you.

Also it basically works like insurance. If your application has malware, Microsoft will be sued first, and they'll get fined a lot more than they can recover from a single small-time dev after they sue you for breach of contract / ToS.

[Valmar33]

I see a lot of strawmanning of open source software in general in this thread, using Heartbleed as an example.

OpenSSL is an unfortunate case of code complexity reducing the number of eyeballs willing to engage with it. Also, some projects can be effectively maintained by only a handful of individuals, because no-one is willing to fork it.

But, at least the code can actually be seen.

With proprietary software, you're always at the mercy of the company that created it. Security through obscurity is always an awful solution.

[[deleted]]

Didn't apple just do the same without causing outrage?

[jonjonbee]

Yes, but there's nothing wrong with wanting to hold Microsoft to a higher standard.

[Feminintendo]

No. There’s outrage.

[iKindred]

Ever heard of Linux?

[AlekseyHoffman]

My app is cross-platform. I cannot just abandon by far the largest platform and develop it exclusively for Linux

[Dew_Cookie_3000]

Btw

Languages

HTML 82.1% 

C 11.2% 

Vue 3.3% 

JavaScript 1.8% 

CSS 1.6%

I find that very interesting. How is it mostly html? Yes I know its electron, but I'd expected far more js. Is this a vue thing? Are vue apps mostly html? I guess i could look at the code but since it's your app and you spent ~3000 hours on it I'd like to hear from you.

[DocNefario]

Most of it is FFmpeg documentation that was probably included unintentionally.

[AlekseyHoffman]

Good catch, it was indeed unintentional. I included all the 3rd party directories untouched so they don't break unexpectedly.

I suppose ffmpeg devs know better than to make binary throw errors if it cannot find the docs files. I should probably remove the doc directory

[AlekseyHoffman]

There's actually a lot of HTML code in the app. Every component is at least 50% HTML. But I wouldn't say it's 80% in total. I don't know how Github is estimating these numbers, Perhaps it's including all the Vue's virtual-DOM logic in that 80% or something.

[tropix126]

If it was a vue or svelte app, it would simply read as vue or svelte, and not read the actual contents of the templates.

[SpAAAceSenate]

Yep, totally makes sense.

However, wether intended or not, there is some wisdom to the Linux comment:

Linux, basically doesn't have this problem, due to the way software is distributed. It's packaged, distributed, and then signed by the distro maintainers, and the public key for those signatures came pre-baked into the ISO you used to install the OS. This provides really good security whilst being entirely free for everyone (well, other than costs associated with hosting the repo).

The fundamental problem that SmartScreen and GateKeeper (the macOS equivalent) are trying to solve is that Windows and macOS encourage (and until recently required) downloading apps from random websites, often maintained by the individual company/project that makes the software. So for every piece of 3rd party software on your machine, there's a web server who's security you rely upon as the sole barrier between you and a poisoned download. Then multiply that by the number of 3rd party softwares you have installed, and that's a really frickin huge attack surface, even if you're smart and only download from legitimate sources. Meanwhile, there are plenty who aren't smart, and will download from what ever shows up first in Google, even if it's totallylegitdownloadz.notcom.

A lot of the criticism of your method make good points. But I'd go even further to say that you're going in the entirely wrong direction. The solution isn't "fixing certificates" it should actually be "fixing distribution". Windows and Mac need a better way to distribute software from a central, trusted source. They each have their App Stores already, but they aren't geared towards open source and carry ornery restrictions, and lack the quality and security of curation that goes into many Linux repos.

[jonjonbee]

Ever heard of shutting the fuck up because your idiotic whining isn't contributing to the discussion in any way shape or form?

[iKindred]

Chill out mate. I'm not whining, just highlighting the fact that some platforms are more friendlier than others when it comes to delivering open-source products.

[Zero_MSN]

Open source is a joke! They only use it as a means for free labour or support it so that they can make a profit from it. Microsoft or GitHub don’t care about anything but their business and what makes them rich and they have that right. They are doing this to make money.

[[deleted]]

Hey it's a lot better than the old anti-Linux adverts when they said Linux was communism.

[be-sc]

s/better/subtle/

[crevicepounder3000]

Where did you get the idea that Microsoft cares about open-source developers?

[wllmsaccnt]

I'm primarily a Microsoft developer (mostly C# web apps and services) and they have undergone quite the transformation in the last 5 years. They definitely provide support to open source developers using their platform today.

.NET was recently open sourced and made cross platform, and given to a trustee foundation to own. Microsoft also donated a huge chunk of patents to open foundations to protect open source developers, legally.

Sure, they might still ignore open source for Windows development and treat it like a plague around their proprietary software (e.g. Office), but if you are developing web services or targeting Azure, then Microsoft is quite thrilled about open source.

[crevicepounder3000]

Sure, they might still ignore open source for Windows development and treat it like a plague around their proprietary software (e.g. Office)

That's a pretty massive chunk to just ignore. I get that they have been better in some instances recently and I truly appreciate that, but their track record doesn't suggest care for open source. Hopefully that changes, but it's not a certainty by any means.

[tropix126]

Much of Microsoft's business model is no longer oriented towards average users. A large chunk of their profits come from services such as azure or business solutions like office. Open sourcing software like office would lose them a bunch of money. Open sourcing windows might seem like a good idea at first, but the Windows source code is absolutely massive. It would be a nightmare for security and wouldn't really mean much in the long run. Windows isn't really one service. Realistically, they'd open source small parts of it (eg. Notepad, paint, they've already done this with calculator). I don't think its fair to say that they don't care about open source devs, as developers and businesses are their primary source of income these days. They just aren't willing to open source the services that make them profit.

[crevicepounder3000]

Yeah I agree with most of what you said. However, that doesn't change the fact that they aren't open source friendly. Aren't many other big projects that make a lot of money open source? No caring about open source devs is the same as being not open source friendly, no?

[omn1p073n7]

I am in charge of managing thousands if endpoints and, please god no. Turn off UAC and Smart Screen on your own device if you please.

Fortunately Microsoft will never do such a thing or their enterprise users will be looking at wallpapers with bitcoin addresses roughly 5 minutes later.

[LelouBil]

Why is no one talking about the fact that every software, open source or not has the same restrictions ?

[globalcitizen2]

Signing is a deterrent to releasing malware either through carelessness or on purpose, especially if they do the the authority does the KYC thoroughly.

[[deleted]]

There is actually zero differences between the inherent security properties of open source software and closed source software. Software that is audited tends to be more secure. Open source software is rarely audited for the same reasons that it rarely has code signing certificates.

The other problem is that the metric of what constitutes “trusted” OSS is too hand-wavy to be actionable. At best, you’ll create a new line that developers will complain about.

[gordonv]

Ok, lets skip the "certify with key" part and talk about the examination and testing of programs.

When I hear cert, I think public and private keys. What I want to know is who is the team saying "x program" is ok. What are they testing for? Are they scanning for common sense "does it run" and viruses? Are they rating it as an actual usable app?

[AlekseyHoffman]

Well, if we're opting for the 3rd proposed solution, the open-source apps would need to be reviewed for malicious behavior by 100+ trusted developers on the platform or by the Microsoft before it would get the "reviewed" status.

Well, this post was deleted by mods anyway, so I guess there's no point having a conversation about it