Releasing closed source on Windows without looking suspicious

Started by
22 comments, last by Endurion 6 years, 2 months ago
22 minutes ago, Yesindiedee said:

I have seriously considered releasing android versions for this reason. Out of interest would you trust a native Linux version more than Windows?

Anecdotally yes, based on the very little I know about the security model. Providing you don't desire the latest graphics, and can live with optimizing for lower power machines then Android (and iOS) make a lot of sense imo. Far easier to deploy. One of my testers is an expert at installing / uninstalling, and he's 5 years old. :)

Advertisement
4 hours ago, Yesindiedee said:

So, what would be a good way to release closed source software which inspires trust in people?

Signing your installer with a certificate will make Windows behave in a more friendly way.

As other pointed out, does it have to be an .exe? Perhaps just .zip is enough for your game?

If you absolutely need an installer try to look into .msi installers - these tend to look more legit than some random .exe.

Itch.io definitely is a decent way to increase trust-level of your binaries, mostly due to their sandbox.

But the same goes for any other store front. I trust Steam/Apple/Microsoft to have at least run anti-virus against anything being distributed through their stores. If I download directly from your site, I have to take on that burden myself, and hope my anti-virus software is up to the task.

Tristam MacDonald. Ex-BigTech Software Engineer. Future farmer. [https://trist.am]

Not sure how useful this is, but I've seen some people upload their apps to a site like https://www.virustotal.com and then link to the generated report.

14 hours ago, Yesindiedee said:

In the past I have had to use code signing for client work, but as far as I can see that just boils down to: If you pay some money, you become trusted.

In theory, paying for a certificate means that your identity is verified. Your installer can be traced back to your business registration details. If you're doing something malicious, the police can track you down. That means you're responsible, and responsibility = trust.

An unsigned app could've been written by anyone, and they can just disappear when it comes time to take the blame. This is probably why Windows prefers installers to be signed.

2 hours ago, Hodgman said:

This is probably why Windows prefers installers to be signed

Also note that Mac OS now actually refuses to allow unsigned binaries to be installed without the user manually opening System Preferences, authorising the app, clicking through warnings, and finally entering the administrator password.

As you can imagine, this has a pretty chilling effect on folks installing unsigned software...

Tristam MacDonald. Ex-BigTech Software Engineer. Future farmer. [https://trist.am]

I'm from china.
Here's my homepage: www.rlzl.net , indie game developers.
I have no ftp-server, all data from other download site.
I will provide a hash and readme file write in:
"Use your antivirus software to do my application scan for virus infections"

@dream rz I am not sure how helpful your reply is to the whole conversation.

What @Hodgman suggested is something I would do, I would probably also invest in some time/money into a code signing certificate which is trusted by the usual suspects. Everything else is up to the user.

If I end up downloading stuff, executables, I also just upload them to virustotal.com and see for myself.

8 hours ago, rlyeh said:

@dream rz I am not sure how helpful your reply is to the whole conversation.

I had always thought You are all trust "antivirus software". McAfee, Avira Free Antivirus, Kaspersky, ESET NOD32...
Anti-virus software is a necessary part of any security implementation, why do you use “code signing”?
I suppose there must be some discrepancies between us in comprehension.
In our country........sorry, piracy software is everywhere. what is a trusted publisher?
Use more "antivirus software".

Aside from code signing which is absolutely the best way to gain trust, no way around it, because it actually ties the piece of software to you / your company and protects it from manipulation, the small things like zipping it along with some documentation / license text / whatever and setting a proper file icon can help a bit. Everything else is building trust over time.

To tell your users to "use more antivirus software" is certainly not the solution, because most antivirus tools do not play well with others (and some like McAfee behave more like malware themselves...).

Anti-virus software is only the tip of the spear. It is designed to catch exploits which are already well known, or obviously malicious. It generally isn't very good at identifying software that is malicious in subtle ways.

Signing is more about personal trust. The signature attests that you (or your company) are putting your own reputation on the line, that the software is not malicious. Betray that trust significantly, and folks will stop accepting your certificate.

It's not a perfect system, but it at least provides some degree of confidence that I can find you if you destroy my computer :)

Tristam MacDonald. Ex-BigTech Software Engineer. Future farmer. [https://trist.am]

This topic is closed to new replies.

Advertisement